PT-2020-10005 · Avast · Avast Premium Security

Published 2020-01-13 · Updated 2020-01-21 · CVE-2019-18894

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avast Premium Security version 19.8.2393

Description A flaw in Avast Premium Security allows attackers to execute arbitrary OS commands with the privileges of the currently logged in user. This can be achieved by sending a specially crafted request to the local web server on port 27275, which is used to support Bank Mode functionality. For example, attackers who have compromised a browser extension can use this flaw to escape from the browser sandbox.

Recommendations For Avast Premium Security version 19.8.2393, consider restricting access to the local web server on port 27275 until a patch is available. As a temporary workaround, disabling the Bank Mode functionality may help minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-18894

Affected Products

Avast Premium Security

References · 3

• 🔥 https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit · Exploit
• https://osv.dev/vulnerability/CVE-2019-18894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18894 · Security Note