PT-2022-5144 · Avira · Avira Security

Filip Dragovic · Published 2022-10-17 · Updated 2023-08-08 · CVE-2022-3368

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avira Security versions prior to 1.1.72.30556

Description The issue is related to the Software Updater functionality of Avira Security, which allows an attacker with write access to the filesystem to escalate their privileges in certain scenarios. This is due to the possibility of downloading arbitrary files.

Recommendations For versions prior to 1.1.72.30556, update to Avira Security version 1.1.72.30556 to resolve the issue. As a temporary workaround, consider restricting write access to the filesystem to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Incorrect Default Permissions

Weakness Enumeration

CWE-269

CWE-276

Related Identifiers

BDU:2022-06401

CVE-2022-3368

Affected Products

Avira Security

References · 11

• 🔥 https://github.com/Wh04m1001/CVE-2022-3368 · Exploit
• 🔥 https://github.com/pxcs/CrackAVFee · Exploit
• 🔥 https://github.com/byt3n33dl3/CrackAVFee · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3368 · Security Note
• https://bdu.fstec.ru/vul/2022-06401 · Security Note
• https://support.norton.com/sp/static/external/tools/security-advisories.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3368 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/7007 · Telegram Post
• https://t.me/offensivetwitter/1300 · Telegram Post
• https://t.me/cibsecurity/51633 · Telegram Post
• https://t.me/proxy_bar/1078 · Telegram Post