PT-2017-18274 · Avast · Avast Antivirus

Publicado 2017-04-27 · Atualizado 2019-10-03 · CVE-2017-8307

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avast Antivirus versions prior to 17

Description The issue allows unprivileged users to launch predefined binaries, replace or delete arbitrary files when Avast Self-Defense is disabled. It can also be exploited in conjunction with other vulnerabilities when Avast Self-Defense is enabled, allowing for Denial of Service attacks and hiding traces of a possible attack.

Recommendations For Avast Antivirus versions prior to 17, update to version 17 or later to resolve the issue. As a temporary workaround, consider enabling Avast Self-Defense to minimize the risk of exploitation. Restrict access to the LPC interface API exposed by the AvastSVC.exe Windows service to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2017-8307

Produtos afetados

Avast Antivirus

Referências · 4

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201 · Exploit
• http://securityfocus.com/bid/98086 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8307 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8307 · Aviso do Fabricante