The ACL on %PROGRAMDATA%Kaspersky Lab allows BUILTINUsers to create new files. This can be abused to create new plugins and modules during update, and other filesystem races to gain elevated privileges.
C:UsersTavis Ormandy>icacls "%PROGRAMDATA%Kaspersky Lab"
C:ProgramDataKaspersky Lab NT AUTHORITYSYSTEM:(I)(OI)(CI)(F)
BUILTINAdministrators:(I)(OI)(CI)(F)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
BUILTINUsers:(I)(OI)(CI)(RX)
BUILTINUsers:(I)(CI)(WD,AD,WEA,WA)
Successfully processed 1 files; Failed processing 0 files
An example attack is to find the MD5 of an upcoming update, create a DLL at Cacheqscan.kdl.{md5} that does something in DllMain. The next time Kaspersky updates, avp.exe will spawn load the file.
