README.md

Privileged File Delete (CVE-2019-18644)

Affected Products

• Total Defense Anti-virus 11.5.2.28

Vulnerability Type

Improper Access Control

Impact

Privileged File Delete

Summary

The malware scan function in Total Defense Anti-virus is vulnerable to a TOCTOU bug and symbolic link attacks allowing privileged files to be deleted.

Exploitation

1. Disable automatic scanner,
2. Manually scan malware,
3. Delete the malware while scan is in progress,
4. Create a symbolic link from the original malware path to a target file.

Demo

https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Privileged%20File%20Delete/v11.5.2.28/Total%20Defense%20file%20delete.mp4