Vulnerability Description
IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Iobit | Malware Fighter | <= 4.3.1 |
Related Weaknesses (CWE)
References
- http://www.iobit.com/downloadcenter.php?product=malware-fighter-freeProduct
- http://www.iobit.com/en/index.phpProduct
- https://www.exploit-db.com/exploits/40525ExploitVDB Entry
- https://www.vulncheck.com/advisories/iobit-malware-fighter-unquoted-service-pathThird Party Advisory
FAQ
What is CVE-2016-20059?
CVE-2016-20059 is a vulnerability with a CVSS score of 7.8 (HIGH). IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a mali...
How severe is CVE-2016-20059?
CVE-2016-20059 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-20059?
Check the references section above for vendor advisories and patch information. Affected products include: Iobit Malware Fighter.