CVE-2007-4206

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

08/08/2007

Last modified:

29/07/2017

Description

Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4) sets incorrect permissions for application files in certain upgrade scenarios, which might allow local users to gain privileges.

Impact

Vector 2.0

AV:L/AC:M/Au:N/C:P/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 4.40 MEDIUM
Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

Attack Vector (AV): Local
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): Physical

Base Score 2.0

4.40

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:kaspersky_lab:kaspersky_anti-spam::::::::		3.0.274.0 (including)

To consult the complete list of CPE names with products and versions, see this page

References to Advisories, Solutions, and Tools

http://osvdb.org/37216
http://secunia.com/advisories/26312
http://www.kaspersky.com/technews?id=203038705
http://www.securityfocus.com/bid/25189
https://exchange.xforce.ibmcloud.com/vulnerabilities/35782