CVE-2017-9811

This flaw is like a backdoor in the antivirus’s control features: a person who should not be able to manage the system can misuse how the antivirus reads/writes files in quarantine to gain administrator-level control. In practical terms, that means they could take over the Linux server that runs your file-server antivirus.

This matters if your business runs Kaspersky Anti-Virus for Linux File Server (anti-virus for linux server / kaspersky anti-virus for linux file server). The findings say the attacker does not need a special login and does not need user interaction, and the attack path is described as network-based. The exact “reachable in default configuration” condition is not known from the findings, so treat it as a risk if the relevant antivirus control/quarantine actions are reachable from the network in your setup.

This is an AMBER issue because an attacker can use it to obtain full control of the Linux server, and there are public exploits available. Even though it’s not listed in CISA KEV, the high-impact result (full takeover) means you should prioritize patching rather than waiting.

Confirm whether you’re affected

1. Identify the exact product and installed version of Kaspersky Anti-Virus for Linux File Server on the relevant server(s).
2. Compare the version to the known affected boundary: this issue applies to versions before 8.0.4.312.

Patch / upgrade

1. Upgrade to Kaspersky Anti-Virus for Linux File Server Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) or a later version.
2. During the upgrade window, plan for normal service validation (antivirus service starts cleanly; file scanning/quarantine functions behave normally).
3. After the upgrade, re-check the installed version to ensure it is actually 8.0.4.312 or later.

If you cannot patch immediately (workarounds)

1. Restrict network access to any interfaces that could allow interaction with the antivirus control tool/quarantine operations (the findings describe the attack vector as network-based).
2. Ensure the server firewall and any reverse-proxy/WAF rules do not expose unnecessary services from untrusted networks.
3. Apply the principle of least privilege for any operational accounts that can manage the antivirus/quarantine.

What to monitor after patching (and while waiting)

1. Look for suspicious permission changes or unexpected command execution tied to the antivirus control/quarantine functionality.
2. Review logs around quarantine read/write activity, especially any activity that occurs without a known admin operation.

Exploitation status

• CISA KEV listing: not listed in the findings.
• Public exploit availability: the findings state public exploit(s) exist (3 known).

Timeline

• No KEV-based deadline is provided in the findings.

Severity and practical impact

• The findings indicate full control: an unauthorized actor can use the antivirus control tool to change permissions and take over the system.
• The technical description states this is achieved by abusing quarantine read/write operations, leading to privilege escalation to root.

Weakness type and mechanism

• Weakness category: CWE-20 (Improper Input Validation) as provided.
• Mechanism (from findings + backstop): an attacker can interact with the kav4fs-control binary (in affected versions) to manipulate quarantine-related actions, resulting in permission changes and root-level access.

Attack vector and prerequisites

• Authentication required: none (per findings).
• User interaction: none.
• Reachability: not known whether it is reachable in a default configuration (so exposure depends on whether the relevant network-reachable functionality exists in your environment).

Exploitability

• The findings report public exploits are available (3 known).
• CISA KEV: not listed.
• Press attention: rising (not the same as confirmed exploitation).
• EPSS is provided only as a prediction and should not be treated as proof of active exploitation.

Fix

• A concrete remediation version is provided: Maintenance Pack 2 Critical Fix 4, version 8.0.4.312.