CVE-2016-20059— IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation

Quick assessment

Copy summary Copy citation

Affected

Iobit IObit Malware Fighter

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

IOBit Malware Fighter是IOBit公司的一套基于Windows平台的杀毒软件。该软件具有反恶意软件和病毒防护等功能。 IObit Malware Fighter 4.3.1版本存在代码问题漏洞，该漏洞源于IMFservice和LiveUpdateSvc服务存在未加引号的服务路径，可能导致本地攻击者通过在未加引号的服务路径中插入恶意可执行文件实现权限提升。

CVE-2016-20059 affects Iobit IObit Malware Fighter. No confirmed in-the-wild exploitation; assess based on exposure. IOBit Malware Fighter是IOBit公司的一套基于Windows平台的杀毒软件。该软件具有反恶意软件和病毒防护等功能。 IObit Malware Fighter 4.3.1版本存在代码问题漏洞，该漏洞源于IMFservice和LiveUpdateSvc服务存在未加引号的服务路径，可能导致本地攻击者通过在未加引号的服务路径中插入恶意可执行文 CVE-2016-20059 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2016-20059

I. Basic Information for CVE-2016-20059

Affected Products

II. Public POCs for CVE-2016-20059

III. Intelligence Information for CVE-2016-20059

Vendor Advisories for CVE-2016-20059 (1)

• 🔗 IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation | Advisories | VulnCheck Read full article third-party-advisory

Exploits & Public PoCs for CVE-2016-20059 (1)

• 🔗 IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation - Windows local Exploit Read full article exploit

Other References for CVE-2016-20059 (1)

• http://www.iobit.com/downloadcenter.php?product=malware-fighter-free product

• https://www.cve.org/CVERecord?id=CVE-2016-20059

IV. Related Vulnerabilities

V. Comments for CVE-2016-20059