Kaspersky Anti-Virus For Linux Server vulnerabilities

CVE-2017-9811 [CRITICAL] CWE-20 CVE-2017-9811: The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root.

CVE-2017-9812 [HIGH] CWE-200 CVE-2017-9812: The reportId parameter of the getReportStatus action method can be abused in the web interface in Ka The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges.

CVE-2017-9810 [HIGH] CWE-352 CVE-2017-9810: There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux Fi There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.

CVE-2017-9813 [MEDIUM] CWE-79 CVE-2017-9813: In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0. In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS).