SB2019122708 - Link following in K7 Ultimate Security
Published: December 27, 2019 Updated: August 8, 2020
Security Bulletin ID
SB2019122708
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Link following (CVE-ID: CVE-2019-16896)
The vulnerability allows a local authenticated user to execute arbitrary code.
In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the user, allowing an arbitrary file write via a symbolic link attack with file restoration functionality.
Remediation
Install update from vendor's website.