Experts warn of flaws in popular Antivirus solutions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-1161 | An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion. NVD description · AI analysis pending | 7.1 | <1% |
| — | ||
| CVE-2019-19548 | Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2019-19688 +1 in the same advisory: …19689 | A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a m A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file into the application directory and elevate privileges. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2019-8452 | A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file. NVD description · AI analysis pending | 7.8 | 1% | PoC |
| — | |
| CVE-2020-13903 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-12254. Reason: This candidate is a reservation duplicate of CVE-2020-12254. Notes: All CVE users should reference CVE-2020-12254 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage NVD description · AI analysis pending | — | — | — | — | ||
| CVE-2020-25043 | The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the s The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system. NVD description · AI analysis pending | 7.1 | <1% |
| — | ||
| CVE-2020-25044 | Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to elimin Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to eliminate content of any file in the system. NVD description · AI analysis pending | 7.1 | <1% |
| — | ||
| CVE-2020-25045 | Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack th Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2020-7250 | Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to p Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2020-7310 | Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that are Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that are part of write protection rules via manipulating symbolic links to redirect a McAfee file operations to an unintended file. NVD description · AI analysis pending | 6.9 | <1% |
| — | ||
| CVE-2020-9290 | An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in wh An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory. NVD description · AI analysis pending | 7.8 | <1% |
| — |
Full article628 words · extracted from securityaffairs.com · click to collapse
Researchers disclosed details of security flaws in popular antivirus software that could allow threat actors to increase privileges.
Security researchers from CyberArk Labs disclosed details of security vulnerabilities found in popular antivirus software that could be exploited by attackers to elevate their privileges on the target system.
Antivirus solutions that are supposed to protect the systems from infection may unintentionally allow malware in escalating privileges on the system.
Anti-malware products run with high privileges, this means that the exploitation of any issues in these solutions could allow malicious software to elevated permissions and perform multiple malicious actions.
Experts explained that multiple anti-malware products are vulnerable to exploitation via file manipulation attacks, including antivirus solutions from Kaspersky, McAfee, NortonLifeLock, Fortinet, Check Point, Trend Micro, Avira, and Microsoft Defender. The good news is that all the above security vendors have addressed the vulnerabilities reported by the researchers.
The researchers explained that one of the root causes for many issues they have discovered is the default DACLs of the C:\ProgramData directory. On Windows, the ProgramData directory is used by applications to store data, any user has read/write permissions on ProgramData instead of the %LocalAppData%, which is accessible by the current logged in user.
“We begin with the first cause of many bugs, which is the default DACLs of the C:\ProgramData directory. On Windows, the ProgramData directory is used by applications to store data that is not specific to a user. This means that processes\services that are not tied to a specific user would probably use ProgramData instead of the %LocalAppData%, which is accessible by the current logged in user.” reads the analysis published by CyberArk. “I assume this is the reason why ProgramData has permissive DACLs by design so that every user can access directories there freely.”
Attackers could exploit some of the flaws to delete files from arbitrary locations.
A privilege escalation could be achieved when a non-privileged process creates a new folder in “ProgramData” that could be later accessed by a privileged process, like the one associated with an antivirus solution.
To better understand the conditions that could determine the exploitation of the flaws, the analysis provides details about a shared Log File issue that affects the antivirus solution designed by Avira.
An attacker could exploit the privileged process to delete the file and create a symlink that would point to any arbitrary file on the target system with malicious content.
CyberArk researchers also explained that it is possible to create a new folder in “C:\ProgramData” before a privileged process, associated with an antivirus software, is executed.
The experts pointed out that McAfee antivirus installer is executed after creating the “McAfee” folder, the standard user has full control over the directory, this means that the local user could gain elevated permissions through a symlink attack.
Experts also reported DLL hijacking flaws in Trend Micro, Fortinet, and other antivirus solutions that could allow attackers to execute a malicious DLL after having placed it into the application directory and elevate privileges.
DLL Hijacking attacks could be mitigated by updating the update of the installation frameworks.
“The implications of these bugs are often full privilege escalation of the local system,” concludes CyberArk. “Due to the high privilege level of security products, an error in them could help malware to sustain its foothold and cause more damage to the organization. The exploits that were presented here are easy to implement, but also easy to patch against.”
The complete list of issues discovered by the experts is reported below:
- Kaspersky CVE-2020-25045, CVE-2020-25044, CVE-2020-25043
- McAfee CVE-2020-7250, CVE-2020-7310
- NortonLifeLock CVE-2019-19548
- Fortinet CVE-2020-9290
- Checkpoint CVE-2019-8452
- Trend Micro CVE-2019-19688, CVE-2019-19689 +3
- Avira – CVE-2020-13903
- Microsoft-CVE-2019-1161
- Avast + F-Secure – Waiting for Mitre
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, antivirus)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/109115/hacking/antivirus-solutions-flaws.html