NVD

Id
49807  
Name
CVE-2009-2564  
Description
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOSingetPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-07-21  
Modified Date
2010-12-01  
Seq
2009-2564  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
251845 49807 CVE-2009-2564 http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html  View
251846 49807 CVE-2009-2564 oval:org.mitre.oval:def:5719  View
251847 49807 CVE-2009-2564 http://retrogod.altervista.org/9sg_adobe_local.html  View
251848 49807 CVE-2009-2564 1023007  View
251849 49807 CVE-2009-2564 http://www.adobe.com/support/security/bulletins/apsb09-15.html  View
251850 49807 CVE-2009-2564 9199  View
251851 49807 CVE-2009-2564 20090720 Adobe related service (getPlus_HelperSvc.exe) local elevation of privileges  View
251852 49807 CVE-2009-2564 35740  View
251853 49807 CVE-2009-2564 TA09-286B  View
251854 49807 CVE-2009-2564 ADV-2009-1969  View
251855 49807 CVE-2009-2564 ADV-2009-2898  View
251856 49807 CVE-2009-2564 getplus-nos-insecure-permissions(54383)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41242 JVNDB-2009-002249 NOS Microsystems getPlus Download Manager for Adobe における権限昇格の脆弱性 NOS Microsystems getPlus Download Manager for Adobe には、NOSingetPlus_HelperSvc.exe が安全でないアクセス権を保有するため、権限昇格をされる脆弱性が存在します。 CVE-2009-2564 39995 CVE-2009-2564 49807 7.2 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002249.html 2009-07-21 2009-11-20 View