PT-2023-2508 · Avast+1 · Avast Antivirus+1

Published 2023-02-14 · Updated 2023-05-01 · CVE-2023-1585

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Avast Antivirus versions prior to 22.11 AVG Antivirus versions prior to 22.11

Description The issue is related to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, which can lead to arbitrary file or directory deletion. This vulnerability is associated with synchronization errors when using a shared resource.

Recommendations For Avast Antivirus versions prior to 22.11, update to version 22.11 or later and ensure virus definitions from 14 February 2023 or later are installed. For AVG Antivirus versions prior to 22.11, update to version 22.11 or later and ensure virus definitions from 14 February 2023 or later are installed.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2023-02303

CVE-2023-1585

Affected Products

Avg Antivirus

Avast Antivirus

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-1585 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1585 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02303 · Security Note
• https://t.me/proxy_bar/1467 · Telegram Post
• https://t.me/cvenotify/49544 · Telegram Post
• https://t.me/defcon_news/112710 · Telegram Post
• https://support.norton.com/sp/static/external/tools/security-advisories.html · Note
• https://t.me/cibsecurity/62480 · Telegram Post