Intego Antivirus Windows Link Following Arbitrary File Deletion

Executive Summary

This vulnerability is a link following issue in Intego Antivirus for Windows through version 3.0.0.1. It allows local unprivileged users to delete arbitrary folders with SYSTEM privileges by replacing a scanned file's directory with a junction to C:\Config.msi. Attackers can then abuse Windows Installer rollback to execute code as SYSTEM.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for suspicious file deletions or symlink creation in system directories. Check for unexpected changes in C:\Config.msi or other critical folders. Use tools like Process Monitor to track antivirus service actions during file scans. Verify if Intego Antivirus version 3.0.0.1 or earlier is installed and if the optimization module is enabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with local access to escalate privileges to SYSTEM level, potentially leading to full system compromise. It could enable unauthorized code execution, data deletion, or installation of malicious software on affected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily enables local privilege escalation to SYSTEM level, which could allow attackers to gain full control over a system. For compliance standards like GDPR or HIPAA, such a breach could lead to unauthorized access to sensitive data, violating confidentiality requirements. Organizations using affected Intego Antivirus versions may face compliance violations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Intego Antivirus for Windows to the latest version beyond 3.0.0.1 to patch the vulnerability. If an update is unavailable, consider temporarily disabling the optimization module or switching to an alternative antivirus solution until a fix is applied.

Useful 0 Not Useful 0