This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AvastSvc.exe module. By creating a directory junction, an attacker can abuse the service to delete a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12082.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-21-208/ | Third Party Advisory VDB Entry |
Configurations
History
01 Apr 2021, 16:04
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 3.6
v3 : 6.1 |
| CPE | cpe:2.3:a:avast:premium_security:20.8.2429:*:*:*:*:*:*:* | |
| References | (N/A) https://www.zerodayinitiative.com/advisories/ZDI-21-208/ - Third Party Advisory, VDB Entry |
29 Mar 2021, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AvastSvc.exe module. By creating a directory junction, an attacker can abuse the service to delete a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12082. |
29 Mar 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-03-29 21:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-27241
Mitre link : CVE-2021-27241
CVE.ORG link : CVE-2021-27241
JSON object : View
Products Affected
avast
- premium_security
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')