PT-2017-14135 · Ikarus · Ikarus Anti.Virus

Publicado 2017-10-19 · Atualizado 2017-11-14 · CVE-2017-15643

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IKARUS Anti Virus version 2.16.7

Description The issue allows an active network attacker, in a man-in-the-middle (MiTM) position, to achieve remote code execution on a machine running the affected software. This is possible because the software uses cleartext HTTP for updates, relying on a CRC32 checksum and an update value for verification of downloaded files. The attacker can force the client to initiate an update transaction by modifying an HTTP response, leading to the download of a Trojan horse executable file, such as guardxup.exe, which has a correct CRC32 checksum.

Recommendations For IKARUS Anti Virus version 2.16.7, consider disabling the update feature via cleartext HTTP until a secure update mechanism is implemented or a patch is available. Restrict access to the update module to minimize the risk of exploitation. Avoid using the affected update mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2017-15643

Produtos afetados

Ikarus Anti.Virus

Referências · 5

• 🔥 https://blogs.securiteam.com/index.php/archives/3485 · Exploit
• 🔥 https://exploit-db.com/exploits/44055 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15643 · Aviso do Fabricante
• https://ikarussecurity.com/about-ikarus/security-blog/vulnerability-in-windows-antivirus-products-ik-sa-2017-0001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15643 · Nota de Segurança