G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation (CVE-2024-6871)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: (0Day) G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability 2. Vulnerability ID: ZDI-24-1486, ZDI-CAN-22629 3. CVE ID: CVE-2024-6871 4. CVSS Score: 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H 5. Affected Vendor: G DATA 6. Affected Product: Total Security 7. Vulnerability Details: - A local attacker can exploit this vulnerability to escalate privileges on an affected G DATA Total Security installation. - The issue lies in the handling of auto-start tasks. - The problem stems from incorrect permission assignments for a folder. - Attackers can exploit this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. 8. Additional Details: - On February 13, 2024, ZDI reported the vulnerability to the vendor. - On February 14, 2024, the vendor confirmed receipt of the report. - On March 21, 2024, the vendor confirmed the reported issue. - On July 18, 2024, ZDI requested an update. - On July 18, 2024, the vendor indicated that the fix would be released in the fourth quarter of 2024. - On October 7, 2024, ZDI notified the vendor of plans to disclose this vulnerability as a 0-day. 9. Mitigation: Due to the nature of the vulnerability, the only mitigation strategy is to restrict interaction with the application. 10. Disclosure Timeline: - February 13, 2024 – Vulnerability reported to vendor. - November 12, 2024 – Coordinated public disclosure of vulnerability advisory. - November 12, 2024 – Vulnerability advisory updated. 11. Credit: Kolja Grassmann (cirosec GmbH)

Goal Reached Thanks to every supporter — we hit 100%!

G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation (CVE-2024-6871)