PT-2017-14135 · Ikarus · Ikarus Anti.Virus

Published 2017-10-19 · Updated 2017-11-14 · CVE-2017-15643

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IKARUS Anti Virus version 2.16.7

Description The issue allows an active network attacker, in a man-in-the-middle (MiTM) position, to achieve remote code execution on a machine running the affected software. This is possible because the software uses cleartext HTTP for updates, relying on a CRC32 checksum and an update value for verification of downloaded files. The attacker can force the client to initiate an update transaction by modifying an HTTP response, leading to the download of a Trojan horse executable file, such as guardxup.exe, which has a correct CRC32 checksum.

Recommendations For IKARUS Anti Virus version 2.16.7, consider disabling the update feature via cleartext HTTP until a secure update mechanism is implemented or a patch is available. Restrict access to the update module to minimize the risk of exploitation. Avoid using the affected update mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2017-15643

Affected Products

Ikarus Anti.Virus

References · 5

• 🔥 https://blogs.securiteam.com/index.php/archives/3485 · Exploit
• 🔥 https://exploit-db.com/exploits/44055 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15643 · Vendor Advisory
• https://ikarussecurity.com/about-ikarus/security-blog/vulnerability-in-windows-antivirus-products-ik-sa-2017-0001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15643 · Security Note