CVE-2017-9812
HighSummary
The reportId parameter of the getReportStatus action method in the web interface of Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) can be abused to read arbitrary files with kluser privileges.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to sensitive data within the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update the software to version 8.0.4.312 or later to mitigate this vulnerability.
Other vulnerabilities in Kaspersky Anti-Virus for Linux File Server
See all- CVE-2017-9810High
The lack of Anti-CSRF tokens in forms on the web interface of Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) allows an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.
- CVE-2017-9811Critical
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root.
Original NVD description (English source)
The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges.