CVE-2019-18979 : Exploit Details and Defense Strategies

Adaware antivirus versions 12.6.1005.11662 and 12.7.1055.0 contain a flaw that allows for privileged escalation through a specific exploitation method.

Understanding CVE-2019-18979

This CVE identifies a vulnerability in Adaware antivirus that can be exploited for privilege escalation.

What is CVE-2019-18979?

The vulnerability in versions 12.6.1005.11662 and 12.7.1055.0 of Adaware antivirus allows an attacker to use an NTFS directory junction to restore a malicious DLL file from quarantine into the system32 folder, leading to privileged escalation.

The Impact of CVE-2019-18979

Exploitation of this flaw can result in an attacker gaining elevated privileges on the affected system, potentially leading to further compromise or unauthorized access.

Technical Details of CVE-2019-18979

This section provides more technical insights into the vulnerability.

Vulnerability Description

The flaw in Adaware antivirus versions 12.6.1005.11662 and 12.7.1055.0 enables an attacker to perform privileged escalation by manipulating the quarantine feature to restore a harmful DLL file into a critical system directory.

Affected Systems and Versions

Adaware antivirus versions 12.6.1005.11662 and 12.7.1055.0

Exploitation Mechanism

Attackers can exploit this vulnerability by utilizing an NTFS directory junction to move a malicious DLL file from quarantine to the system32 folder, thereby gaining elevated privileges.

Mitigation and Prevention

Protecting systems from CVE-2019-18979 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Adaware antivirus to the latest version that includes a patch for this vulnerability.
Monitor system32 folder for any unauthorized DLL files.

Long-Term Security Practices

Regularly update antivirus software and security patches.
Implement least privilege access controls to limit the impact of potential privilege escalation attacks.

Patching and Updates

Apply security updates and patches provided by Adaware to address the privilege escalation vulnerability in affected versions.