PT-2017-17055 · Avira · Avira Total Security Suite+3

Published 2017-03-21 · Updated 2019-10-03 · CVE-2017-6417

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avira Total Security Suite versions 15.0 and earlier Avira Optimization Suite versions 15.0 and earlier Avira Internet Security Suite versions 15.0 and earlier Avira Free Security Suite versions 15.0 and earlier

Description A code injection issue allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avira process via a "DoubleAgent" attack. This is possible because the products do not use the Protected Processes feature, allowing an attacker to enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry. The self-protection mechanism, intended to block local processes from modifying Image File Execution Options, can be bypassed by temporarily renaming Image File Execution Options during the attack.

Recommendations For Avira Total Security Suite versions 15.0 and earlier, consider disabling the self-protection mechanism temporarily until a patch is available. For Avira Optimization Suite versions 15.0 and earlier, restrict access to the Image File Execution Options in the registry to minimize the risk of exploitation. For Avira Internet Security Suite versions 15.0 and earlier, avoid using arbitrary Application Verifier Provider DLLs under Image File Execution Options until the issue is resolved. For Avira Free Security Suite versions 15.0 and earlier, consider implementing an additional layer of security to monitor and control changes to Image File Execution Options. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2017-6417

Affected Products

Avira Free Security Suite

Avira Internet Security Suite

Avira Optimization Suite

Avira Total Security Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6417 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6417 · Vendor Advisory
• http://cybellum.com/doubleagent-taking-full-control-antivirus · Note
• http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique · Note
• http://securityfocus.com/bid/97021 · Note