PT-2017-2614 · Quick Heal+1 · Quick Heal Antivirus Pro+3

Ashfaq Ansari · Published 2017-05-04 · Updated 2021-09-13 · CVE-2017-8773

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quick Heal Internet Security version 10.1.0.316 Quick Heal Total Security version 10.1.0.316 Quick Heal AntiVirus Pro version 10.1.0.316

Description The issue is caused by a buffer overflow in the dynamic memory due to insufficient validation of the dwCompressionSize parameter in the Microsoft WIM (WIMHEADER V1 PACKED) file header. This can allow a remote attacker to elevate privileges and execute arbitrary code, potentially leading to Remote Code Execution as well as Privilege Escalation.

Recommendations For Quick Heal Internet Security version 10.1.0.316, consider disabling the handling of Microsoft WIM files until a patch is available. For Quick Heal Total Security version 10.1.0.316, restrict access to the module responsible for processing WIM files to minimize the risk of exploitation. For Quick Heal AntiVirus Pro version 10.1.0.316, avoid using the dwCompressionSize parameter in the WIM file header until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2017-01832

CVE-2017-8773

Affected Products

Wim

Quick Heal Antivirus Pro

Quick Heal Internet Security

Quick Heal Total Security

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-8773 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8773 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01832 · Security Note
• http://payatu.com/oob-write-heap-buffer-dwcompressionsize-ms-wim · Note