PT-2019-16820 · Comodo · Comodo Antivirus

David Wells · Published 2019-07-17 · Updated 2020-08-24 · CVE-2019-3971

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Comodo Antivirus versions up to 12.0.0.6810

Description The issue is a local Denial of Service that affects CmdVirth.exe via its LPC port "cmdvrtLPCServerPort". A low-privileged local process can connect to this port and send an LPC DATAGRAM, triggering an Access Violation due to hardcoded NULLs used for the Source parameter in a memcpy operation. This results in CmdVirth.exe and its child svchost.exe instances terminating.

Recommendations For Comodo Antivirus versions up to 12.0.0.6810, as a temporary workaround, consider restricting access to the "cmdvrtLPCServerPort" LPC port to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-3971

Affected Products

Comodo Antivirus

References · 3

• 🔥 https://tenable.com/security/research/tra-2019-34 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3971 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3971 · Vendor Advisory