SB2017082509 - Multiple vulnerabilities in Kaspersky Internet Security

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017082509

SB2017082509 - Multiple vulnerabilities in Kaspersky Internet Security

Published: August 25, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017082509
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2017-12816)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware application to get unauthorized access to the product functionality by using Android IPC.


2) Missing Encryption of Sensitive Data (CVE-ID: CVE-2017-12817)

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted.


Remediation

Install update from vendor's website.

References