CVE-2019-7651
First published: Fri Feb 08 2019(Updated: )
EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\EPP device are not properly protected, leading to unintended impersonation or object creation. This vulnerability has been fixed in version 2018.12 and later.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Emsisoft Anti-Malware | <=2018.12 | |
| <=2018.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.emsisoft.com/en/32517/new-in-2018-12-safe-web-browsing-with-emsisoft-browser-security/
- https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-01-09-emsisoft-Anti-Malware-bypass.md
- https://help.emsisoft.com/en/1760/vulnerability-report-en/
- https://nafiez.github.io/security/bypass/2019/01/08/emsisoft-Anti-Malware-bypass.html
Frequently Asked Questions
What is the severity of CVE-2019-7651?
The severity of CVE-2019-7651 is considered to be medium, as it can lead to unauthorized access due to ACL bypass.
How do I fix CVE-2019-7651?
To fix CVE-2019-7651, update Emsisoft Anti-Malware to version 2018.12 or later.
What causes CVE-2019-7651?
CVE-2019-7651 is caused by EPP.sys failing to enforce proper access controls on the \\.\EPP device.
Who is affected by CVE-2019-7651?
Users of Emsisoft Anti-Malware prior to version 2018.12 are affected by CVE-2019-7651.
What type of vulnerability is CVE-2019-7651?
CVE-2019-7651 is classified as an access control vulnerability that allows unauthorized impersonation.
- collector/nvd-index
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/emsisoft
- canonical/emsisoft anti-malware
- version/emsisoft anti-malware/2018.12