Total Defense Anti-Virus 9.0.0.773 caschelp.exe Search Path untrusted search path

Summaryinfo

A vulnerability classified as critical has been found in Total Defense Anti-Virus 9.0.0.773. This affects an unknown part in the library ccGUIFrm.dll of the file caschelp.exe. Performing a manipulation as part of Search Path results in untrusted search path. This vulnerability is known as CVE-2019-13357. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in Total Defense Anti-Virus 9.0.0.773 (Anti-Malware Software). This affects some unknown processing in the library ccGUIFrm.dll of the file caschelp.exe. The manipulation as part of a Search Path leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.dll, which leads to code execution. SYSTEM-level code execution can be achieved when the ccSchedulerSVC service runs the affected executable.

The weakness was published 09/24/2019. This vulnerability is uniquely identified as CVE-2019-13357 since 07/05/2019. Attacking locally is a requirement. Required for exploitation is a authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/27/2023). The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-142154 and VDB-142153. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• Total Defense

Name

• Anti-Virus

Version

• 9.0.0.773

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion