Intego Antivirus
Monthly
Intego Antivirus for Windows through 3.0.0.1 permits a local unprivileged user to escalate to SYSTEM by exploiting a link-following flaw (CWE-59) in its optimization module. A scanned duplicate file's directory can be replaced with an NTFS junction to C:\Config.msi, allowing arbitrary folder deletion with SYSTEM rights and abuse of Windows Installer rollback to execute code as SYSTEM. Publicly available exploit code exists, but exploitation requires a pre-existing low-privileged interactive Windows account and use of the optimization/duplicate-scan module; this is a credible but bounded local privilege-escalation risk rather than a mass-exploitation emergency.
Intego Antivirus for Windows through 3.0.0.1 permits a local unprivileged user to escalate to SYSTEM by exploiting a link-following flaw (CWE-59) in its optimization module. A scanned duplicate file's directory can be replaced with an NTFS junction to C:\Config.msi, allowing arbitrary folder deletion with SYSTEM rights and abuse of Windows Installer rollback to execute code as SYSTEM. Publicly available exploit code exists, but exploitation requires a pre-existing low-privileged interactive Windows account and use of the optimization/duplicate-scan module; this is a credible but bounded local privilege-escalation risk rather than a mass-exploitation emergency.