Vulnerability-Lookup - Search a vulnerability

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

FKIE_CVE-2024-6510

Vulnerability from fkie_nvd - Published: 2024-09-12 15:18 - Updated: 2024-10-02 17:17

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.

References

	URL	Tags
	a341c0d1-ebf7-493f-a84e-38cf86618674	https://www.cirosec.de/sa/sa-2023-008	Third Party Advisory

Impacted products

	Vendor	Product	Version
	avg	internet_security	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avg:internet_security:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "CC4689F8-6777-46DE-8C27-4C2AA3E4F4E6",
              "versionEndExcluding": "24.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking."
    },
    {
      "lang": "es",
      "value": "La escalada de privilegios locales en AVG Internet Security v24 en Windows permite que un usuario local sin privilegios escale permisos al SYSTEM a trav\u00e9s de secuestro de COM."
    }
  ],
  "id": "CVE-2024-6510",
  "lastModified": "2024-10-02T17:17:46.450",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 6.0,
        "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-09-12T15:18:26.347",
  "references": [
    {
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.cirosec.de/sa/sa-2023-008"
    }
  ],
  "sourceIdentifier": "a341c0d1-ebf7-493f-a84e-38cf86618674",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        },
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ],
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2017-5566

Vulnerability from fkie_nvd - Published: 2017-03-21 16:59 - Updated: 2025-04-20 01:37

Severity ?

6.7 (Medium) - CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

References

URL	Tags
cve@mitre.org	http://cybellum.com/doubleagent-taking-full-control-antivirus/	Third Party Advisory
cve@mitre.org	http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/	Technical Description, Third Party Advisory
cve@mitre.org	http://www.securityfocus.com/bid/97022	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://cybellum.com/doubleagent-taking-full-control-antivirus/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/	Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/97022	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
avg	anti-virus	17.1
avg	internet_security	17.1
avg	ultimate	17.1

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avg:anti-virus:17.1:*:*:*:free:*:*:*",
              "matchCriteriaId": "E10A47BF-3351-4E89-873D-609915CC2B18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:avg:internet_security:17.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "25D72625-34F8-478F-B5A7-19CD4F2EAF47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:avg:ultimate:17.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2813B900-C217-400B-8600-1396C77D4DA0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a \"DoubleAgent\" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n de c\u00f3digo AVG Ultimate 17.1 (y versiones anteriores), AVG Internet Security 17.1 (y versiones anteriores) y AVG AntiVirus FREE 17.1 (y versiones anteriores), permite a atacante local evitar un mecanismo de autoprotecci\u00f3n inyectar c\u00f3digo arbitrario, y tomar el control total de cualquier proceso AVG a trav\u00e9s de un ataque\"DoubleAgent\". Una perspectiva de este problema es que (1) estos productos no utilizan la caracter\u00edstica de procesos protegidos y, por lo tanto, un atacante puede introducir un proveedor verificador de aplicaciones DLL arbitrario bajo opciones de ejecuci\u00f3n de archivo de imagen en el registro; (2) el mecanismo de autoprotecci\u00f3n est\u00e1 destinado a bloquear todos los procesos locales (independientemente de los privilegios) de modificar las opciones de ejecuci\u00f3n de archivos de imagen para estos productos; Y (3) este mecanismo puede ser anulado por un atacante que cambia temporalmente las opciones de ejecuci\u00f3n de archivo de imagen durante el ataque."
    }
  ],
  "id": "CVE-2017-5566",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-03-21T16:59:00.333",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/97022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/97022"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2015-8578

Vulnerability from fkie_nvd - Published: 2015-12-16 18:59 - Updated: 2025-04-12 10:46

Severity ?

Summary

AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.

References

URL	Tags
cve@mitre.org	http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations
cve@mitre.org	http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/
cve@mitre.org	http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/	Exploit
cve@mitre.org	http://www.securityfocus.com/bid/78813
af854a3a-2127-422b-91ae-364da2661108	http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations
af854a3a-2127-422b-91ae-364da2661108	http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/
af854a3a-2127-422b-91ae-364da2661108	http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/78813

Impacted products

	Vendor	Product	Version
	avg	internet_security	2015

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avg:internet_security:2015:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E9545D8-62D1-4861-9AA1-B602F9060B89",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "AVG Internet Security 2015 asigna la memoria con permisos Read, Write, Execute (RWX) en direcciones predecibles cuando est\u00e1 protegiendo procesos modo-usuario, lo que permite a atacantes eludir los mecanismos de protecci\u00f3n DEP y ASLR a trav\u00e9s de vectores no especificados."
    }
  ],
  "id": "CVE-2015-8578",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-12-16T18:59:01.547",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/78813"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/78813"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2014-9632

Vulnerability from fkie_nvd - Published: 2015-02-06 15:59 - Updated: 2025-04-12 10:46

Severity ?

Summary

The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call.

References

URL	Tags
cve@mitre.org	http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html	Exploit, Third Party Advisory
cve@mitre.org	http://www.avg.com/eu-en/avg-release-notes	Vendor Advisory
cve@mitre.org	http://www.exploit-db.com/exploits/35993	Exploit, Third Party Advisory
cve@mitre.org	http://www.greyhathacker.net/?p=818	Third Party Advisory
cve@mitre.org	http://www.osvdb.org/113824	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.avg.com/eu-en/avg-release-notes	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.exploit-db.com/exploits/35993	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.greyhathacker.net/?p=818	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/113824	Broken Link

Impacted products

Vendor	Product	Version
avg	protection	*
avg	internet_security	*
avg	internet_security	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avg:protection:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B3618EB-6A5A-4ACC-9163-EF1A40584839",
              "versionEndIncluding": "2015.5314",
              "versionStartIncluding": "2015",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avg:internet_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBBFC61E-CDD6-4E0E-89AD-CDBA0F45EF39",
              "versionEndExcluding": "2013.3495",
              "versionStartIncluding": "2013",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:avg:internet_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73E45897-5653-47E5-AD67-4B6D486A334A",
              "versionEndExcluding": "2015.5314",
              "versionStartIncluding": "2015",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call."
    },
    {
      "lang": "es",
      "value": "El controlador TDI (avgtdix.sys) en AVG Internet Security anterior a 2013.3495 Hot Fix 18 y 2015.x anterior a 2015.5315 y Protection anterior a 2015.5315 permite a usuarios locales escribir a localizaciones de memoria arbitrarias, y como consecuencia ganar privilegios, a trav\u00e9s de una llamada 0x830020f8 IOCTL manipulada."
    }
  ],
  "id": "CVE-2014-9632",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-02-06T15:59:00.057",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.avg.com/eu-en/avg-release-notes"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://www.exploit-db.com/exploits/35993"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.greyhathacker.net/?p=818"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.osvdb.org/113824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.avg.com/eu-en/avg-release-notes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "http://www.exploit-db.com/exploits/35993"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.greyhathacker.net/?p=818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.osvdb.org/113824"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2010-5152

Vulnerability from fkie_nvd - Published: 2012-08-25 21:55 - Updated: 2025-04-11 00:51

Severity ?

Summary

Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute

References

	URL	Tags
	cve@mitre.org	http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html
	cve@mitre.org	http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html
	cve@mitre.org	http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
	cve@mitre.org	http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php
	cve@mitre.org	http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php
	cve@mitre.org	http://www.f-secure.com/weblog/archives/00001949.html
	cve@mitre.org	http://www.osvdb.org/67660
	cve@mitre.org	http://www.securityfocus.com/bid/39924
	cve@mitre.org	http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/
	af854a3a-2127-422b-91ae-364da2661108	http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html
	af854a3a-2127-422b-91ae-364da2661108	http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html
	af854a3a-2127-422b-91ae-364da2661108	http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
	af854a3a-2127-422b-91ae-364da2661108	http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php
	af854a3a-2127-422b-91ae-364da2661108	http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php
	af854a3a-2127-422b-91ae-364da2661108	http://www.f-secure.com/weblog/archives/00001949.html
	af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/67660
	af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/39924
	af854a3a-2127-422b-91ae-364da2661108	http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/

Impacted products

	Vendor	Product	Version
	avg	internet_security	9.0.791
	microsoft	windows_xp	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avg:internet_security:9.0.791:*:*:*:*:*:*:*",
              "matchCriteriaId": "77394750-F072-4B02-871C-A35216541457",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E61F1C9B-44AF-4B35-A7B2-948EEF7639BD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute"
    },
    {
      "lang": "es",
      "value": "** EN DISPUTA ** Condici\u00f3n de Carrera en AVG Internet Security v9.0.791 para Windows XP permite a usuarios locales eludir los manejadores de hooks a nivel de kernel, y ejecutar c\u00f3digo peligroso que de otra manera ser\u00eda bloqueada por el manejador y no por una detecci\u00f3n basada en firma de malware. Esto se consigue a trav\u00e9s de ciertos cambios en la memoria de espacio de usuario durante la ejecuci\u00f3n del manejador de hooks. Se trata de un problema tambi\u00e9n conocido como un ataque argument-switch o un ataque KHOBE. NOTA: este problema es discutido por algunos, ya que es un defecto en un mecanismo de protecci\u00f3n para situaciones en las que un programa hecho a mano ya ha comenzado a ejecutarse.\r\n"
    }
  ],
  "id": "CVE-2010-5152",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 1.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-08-25T21:55:02.337",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.f-secure.com/weblog/archives/00001949.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/67660"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/39924"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.f-secure.com/weblog/archives/00001949.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/67660"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/39924"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-6510 (GCVE-0-2024-6510)

Vulnerability from cvelistv5 – Published: 2024-09-12 14:18 – Updated: 2024-09-12 15:12

Summary

Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-749 - Exposed Dangerous Method or Function
CWE-427 - Uncontrolled Search Path Element
CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

cirosec

References

URL

Tags

https://www.cirosec.de/sa/sa-2023-008

third-party-advisory

Impacted products

	Vendor	Product	Version
	AVG	Internet Security	Affected: 0 , ≤ 24.0 (semver) Unaffected: 24.1

Credits

Kolja Grassmann <kolja.grassmann@cirosec.de>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:avg:internet_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "internet_security",
            "vendor": "avg",
            "versions": [
              {
                "lessThan": "24.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-12T15:10:17.552802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T15:12:46.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Internet Security",
          "vendor": "AVG",
          "versions": [
            {
              "lessThanOrEqual": "24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "24.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kolja Grassmann \u003ckolja.grassmann@cirosec.de\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. \u003cbr\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\n\n\u003c/div\u003e\n\n\u003c/div\u003e\n\n\u003c/div\u003e"
            }
          ],
          "value": "Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749 Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-12T14:18:32.152Z",
        "orgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
        "shortName": "cirosec"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cirosec.de/sa/sa-2023-008"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update \nAVG Internet Security to 24.1"
            }
          ],
          "value": "Update \nAVG Internet Security to 24.1"
        }
      ],
      "source": {
        "advisory": "SA-2023-008",
        "discovery": "USER"
      },
      "title": "Local privilege escalation vulnerability in AVG Internet Security",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
    "assignerShortName": "cirosec",
    "cveId": "CVE-2024-6510",
    "datePublished": "2024-09-12T14:18:32.152Z",
    "dateReserved": "2024-07-04T11:20:14.543Z",
    "dateUpdated": "2024-09-12T15:12:46.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5566 (GCVE-0-2017-5566)

Vulnerability from cvelistv5 – Published: 2017-03-21 16:00 – Updated: 2024-08-05 15:04

Summary

Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://cybellum.com/doubleagent-taking-full-contr…	x_refsource_MISC
	http://www.securityfocus.com/bid/97022	vdb-entryx_refsource_BID
	http://cybellum.com/doubleagentzero-day-code-inje…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:15.384Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
          },
          {
            "name": "97022",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97022"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-03-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a \"DoubleAgent\" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-24T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
        },
        {
          "name": "97022",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97022"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-5566",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a \"DoubleAgent\" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cybellum.com/doubleagent-taking-full-control-antivirus/",
              "refsource": "MISC",
              "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
            },
            {
              "name": "97022",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97022"
            },
            {
              "name": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/",
              "refsource": "MISC",
              "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-5566",
    "datePublished": "2017-03-21T16:00:00",
    "dateReserved": "2017-01-22T00:00:00",
    "dateUpdated": "2024-08-05T15:04:15.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8578 (GCVE-0-2015-8578)

Vulnerability from cvelistv5 – Published: 2015-12-16 18:00 – Updated: 2024-08-06 08:20

Summary

AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://breakingmalware.com/vulnerabilities/sedati…	x_refsource_MISC
	http://www.securityfocus.com/bid/78813	vdb-entryx_refsource_BID
	http://blog.ensilo.com/the-av-vulnerability-that-…	x_refsource_MISC
	http://breakingmalware.com/vulnerabilities/vulner…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
          },
          {
            "name": "78813",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78813"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
        },
        {
          "name": "78813",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78813"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8578",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/",
              "refsource": "MISC",
              "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
            },
            {
              "name": "78813",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/78813"
            },
            {
              "name": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations",
              "refsource": "MISC",
              "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
            },
            {
              "name": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/",
              "refsource": "MISC",
              "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8578",
    "datePublished": "2015-12-16T18:00:00",
    "dateReserved": "2015-12-16T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9632 (GCVE-0-2014-9632)

Vulnerability from cvelistv5 – Published: 2015-02-06 15:00 – Updated: 2024-08-06 13:47

Summary

The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://www.greyhathacker.net/?p=818	x_refsource_MISC
	http://www.exploit-db.com/exploits/35993	exploitx_refsource_EXPLOIT-DB
	http://www.avg.com/eu-en/avg-release-notes	x_refsource_CONFIRM
	http://www.osvdb.org/113824	vdb-entryx_refsource_OSVDB
	http://packetstormsecurity.com/files/130248/AVG-I…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:41.915Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.greyhathacker.net/?p=818"
          },
          {
            "name": "35993",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/35993"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.avg.com/eu-en/avg-release-notes"
          },
          {
            "name": "113824",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/113824"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-02-06T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.greyhathacker.net/?p=818"
        },
        {
          "name": "35993",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/35993"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.avg.com/eu-en/avg-release-notes"
        },
        {
          "name": "113824",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/113824"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9632",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.greyhathacker.net/?p=818",
              "refsource": "MISC",
              "url": "http://www.greyhathacker.net/?p=818"
            },
            {
              "name": "35993",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/35993"
            },
            {
              "name": "http://www.avg.com/eu-en/avg-release-notes",
              "refsource": "CONFIRM",
              "url": "http://www.avg.com/eu-en/avg-release-notes"
            },
            {
              "name": "113824",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/113824"
            },
            {
              "name": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9632",
    "datePublished": "2015-02-06T15:00:00",
    "dateReserved": "2015-01-22T00:00:00",
    "dateUpdated": "2024-08-06T13:47:41.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-5152 (GCVE-0-2010-5152)

Vulnerability from cvelistv5 – Published: 2012-08-25 21:00 – Updated: 2024-09-16 16:43

Summary

Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://archives.neohapsis.com/archives/bugtraq/20…	mailing-listx_refsource_BUGTRAQ
	http://countermeasures.trendmicro.eu/you-just-can…	x_refsource_MISC
	http://www.securityfocus.com/bid/39924	vdb-entryx_refsource_BID
	http://matousec.com/info/articles/khobe-8.0-earth…	x_refsource_MISC
	http://archives.neohapsis.com/archives/fulldisclo…	mailing-listx_refsource_FULLDISC
	http://www.osvdb.org/67660	vdb-entryx_refsource_OSVDB
	http://www.theregister.co.uk/2010/05/07/argument_…	x_refsource_MISC
	http://www.f-secure.com/weblog/archives/00001949.html	x_refsource_MISC
	http://matousec.com/info/advisories/khobe-8.0-ear…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:09:39.206Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
          },
          {
            "name": "39924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/39924"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
          },
          {
            "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
          },
          {
            "name": "67660",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/67660"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.f-secure.com/weblog/archives/00001949.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-08-25T21:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
        },
        {
          "name": "39924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/39924"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
        },
        {
          "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
        },
        {
          "name": "67660",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/67660"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.f-secure.com/weblog/archives/00001949.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-5152",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED ** Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
            },
            {
              "name": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/",
              "refsource": "MISC",
              "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
            },
            {
              "name": "39924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/39924"
            },
            {
              "name": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php",
              "refsource": "MISC",
              "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
            },
            {
              "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
            },
            {
              "name": "67660",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/67660"
            },
            {
              "name": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/",
              "refsource": "MISC",
              "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
            },
            {
              "name": "http://www.f-secure.com/weblog/archives/00001949.html",
              "refsource": "MISC",
              "url": "http://www.f-secure.com/weblog/archives/00001949.html"
            },
            {
              "name": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php",
              "refsource": "MISC",
              "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-5152",
    "datePublished": "2012-08-25T21:00:00Z",
    "dateReserved": "2012-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T16:43:34.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-6510 (GCVE-0-2024-6510)

Vulnerability from nvd – Published: 2024-09-12 14:18 – Updated: 2024-09-12 15:12

Summary

Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-749 - Exposed Dangerous Method or Function
CWE-427 - Uncontrolled Search Path Element
CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

cirosec

References

URL

Tags

https://www.cirosec.de/sa/sa-2023-008

third-party-advisory

Impacted products

	Vendor	Product	Version
	AVG	Internet Security	Affected: 0 , ≤ 24.0 (semver) Unaffected: 24.1

Credits

Kolja Grassmann <kolja.grassmann@cirosec.de>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:avg:internet_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "internet_security",
            "vendor": "avg",
            "versions": [
              {
                "lessThan": "24.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-12T15:10:17.552802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T15:12:46.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Internet Security",
          "vendor": "AVG",
          "versions": [
            {
              "lessThanOrEqual": "24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "24.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kolja Grassmann \u003ckolja.grassmann@cirosec.de\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. \u003cbr\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\n\n\u003c/div\u003e\n\n\u003c/div\u003e\n\n\u003c/div\u003e"
            }
          ],
          "value": "Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749 Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-12T14:18:32.152Z",
        "orgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
        "shortName": "cirosec"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cirosec.de/sa/sa-2023-008"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update \nAVG Internet Security to 24.1"
            }
          ],
          "value": "Update \nAVG Internet Security to 24.1"
        }
      ],
      "source": {
        "advisory": "SA-2023-008",
        "discovery": "USER"
      },
      "title": "Local privilege escalation vulnerability in AVG Internet Security",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
    "assignerShortName": "cirosec",
    "cveId": "CVE-2024-6510",
    "datePublished": "2024-09-12T14:18:32.152Z",
    "dateReserved": "2024-07-04T11:20:14.543Z",
    "dateUpdated": "2024-09-12T15:12:46.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5566 (GCVE-0-2017-5566)

Vulnerability from nvd – Published: 2017-03-21 16:00 – Updated: 2024-08-05 15:04

Summary

Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://cybellum.com/doubleagent-taking-full-contr…	x_refsource_MISC
	http://www.securityfocus.com/bid/97022	vdb-entryx_refsource_BID
	http://cybellum.com/doubleagentzero-day-code-inje…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:15.384Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
          },
          {
            "name": "97022",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97022"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-03-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a \"DoubleAgent\" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-03-24T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
        },
        {
          "name": "97022",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97022"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-5566",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a \"DoubleAgent\" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cybellum.com/doubleagent-taking-full-control-antivirus/",
              "refsource": "MISC",
              "url": "http://cybellum.com/doubleagent-taking-full-control-antivirus/"
            },
            {
              "name": "97022",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97022"
            },
            {
              "name": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/",
              "refsource": "MISC",
              "url": "http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-5566",
    "datePublished": "2017-03-21T16:00:00",
    "dateReserved": "2017-01-22T00:00:00",
    "dateUpdated": "2024-08-05T15:04:15.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8578 (GCVE-0-2015-8578)

Vulnerability from nvd – Published: 2015-12-16 18:00 – Updated: 2024-08-06 08:20

Summary

AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://breakingmalware.com/vulnerabilities/sedati…	x_refsource_MISC
	http://www.securityfocus.com/bid/78813	vdb-entryx_refsource_BID
	http://blog.ensilo.com/the-av-vulnerability-that-…	x_refsource_MISC
	http://breakingmalware.com/vulnerabilities/vulner…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
          },
          {
            "name": "78813",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78813"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
        },
        {
          "name": "78813",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78813"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8578",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/",
              "refsource": "MISC",
              "url": "http://breakingmalware.com/vulnerabilities/sedating-watchdog-abusing-security-products-bypass-mitigations/"
            },
            {
              "name": "78813",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/78813"
            },
            {
              "name": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations",
              "refsource": "MISC",
              "url": "http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations"
            },
            {
              "name": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/",
              "refsource": "MISC",
              "url": "http://breakingmalware.com/vulnerabilities/vulnerability-patching-learning-from-avg-on-doing-it-right/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8578",
    "datePublished": "2015-12-16T18:00:00",
    "dateReserved": "2015-12-16T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9632 (GCVE-0-2014-9632)

Vulnerability from nvd – Published: 2015-02-06 15:00 – Updated: 2024-08-06 13:47

Summary

The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://www.greyhathacker.net/?p=818	x_refsource_MISC
	http://www.exploit-db.com/exploits/35993	exploitx_refsource_EXPLOIT-DB
	http://www.avg.com/eu-en/avg-release-notes	x_refsource_CONFIRM
	http://www.osvdb.org/113824	vdb-entryx_refsource_OSVDB
	http://packetstormsecurity.com/files/130248/AVG-I…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:41.915Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.greyhathacker.net/?p=818"
          },
          {
            "name": "35993",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/35993"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.avg.com/eu-en/avg-release-notes"
          },
          {
            "name": "113824",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/113824"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-02-06T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.greyhathacker.net/?p=818"
        },
        {
          "name": "35993",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/35993"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.avg.com/eu-en/avg-release-notes"
        },
        {
          "name": "113824",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/113824"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9632",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.greyhathacker.net/?p=818",
              "refsource": "MISC",
              "url": "http://www.greyhathacker.net/?p=818"
            },
            {
              "name": "35993",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/35993"
            },
            {
              "name": "http://www.avg.com/eu-en/avg-release-notes",
              "refsource": "CONFIRM",
              "url": "http://www.avg.com/eu-en/avg-release-notes"
            },
            {
              "name": "113824",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/113824"
            },
            {
              "name": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/130248/AVG-Internet-Security-2015.0.5315-Privilege-Escalation.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9632",
    "datePublished": "2015-02-06T15:00:00",
    "dateReserved": "2015-01-22T00:00:00",
    "dateUpdated": "2024-08-06T13:47:41.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-5152 (GCVE-0-2010-5152)

Vulnerability from nvd – Published: 2012-08-25 21:00 – Updated: 2024-09-16 16:43

Summary

Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute

Severity ?

No CVSS data available.

CWE

n/a

Assigner

mitre

References

URL

Tags

	http://archives.neohapsis.com/archives/bugtraq/20…	mailing-listx_refsource_BUGTRAQ
	http://countermeasures.trendmicro.eu/you-just-can…	x_refsource_MISC
	http://www.securityfocus.com/bid/39924	vdb-entryx_refsource_BID
	http://matousec.com/info/articles/khobe-8.0-earth…	x_refsource_MISC
	http://archives.neohapsis.com/archives/fulldisclo…	mailing-listx_refsource_FULLDISC
	http://www.osvdb.org/67660	vdb-entryx_refsource_OSVDB
	http://www.theregister.co.uk/2010/05/07/argument_…	x_refsource_MISC
	http://www.f-secure.com/weblog/archives/00001949.html	x_refsource_MISC
	http://matousec.com/info/advisories/khobe-8.0-ear…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:09:39.206Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
          },
          {
            "name": "39924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/39924"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
          },
          {
            "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
          },
          {
            "name": "67660",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/67660"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.f-secure.com/weblog/archives/00001949.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-08-25T21:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
        },
        {
          "name": "39924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/39924"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
        },
        {
          "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
        },
        {
          "name": "67660",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/67660"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.f-secure.com/weblog/archives/00001949.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-5152",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED ** Race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
            },
            {
              "name": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/",
              "refsource": "MISC",
              "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
            },
            {
              "name": "39924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/39924"
            },
            {
              "name": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php",
              "refsource": "MISC",
              "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
            },
            {
              "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
            },
            {
              "name": "67660",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/67660"
            },
            {
              "name": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/",
              "refsource": "MISC",
              "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
            },
            {
              "name": "http://www.f-secure.com/weblog/archives/00001949.html",
              "refsource": "MISC",
              "url": "http://www.f-secure.com/weblog/archives/00001949.html"
            },
            {
              "name": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php",
              "refsource": "MISC",
              "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-5152",
    "datePublished": "2012-08-25T21:00:00Z",
    "dateReserved": "2012-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T16:43:34.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Search criteria

15 vulnerabilities found for internet_security by avg

FKIE_CVE-2024-6510

FKIE_CVE-2017-5566

FKIE_CVE-2015-8578

FKIE_CVE-2014-9632

FKIE_CVE-2010-5152

CVE-2024-6510 (GCVE-0-2024-6510)

CVE-2017-5566 (GCVE-0-2017-5566)

CVE-2015-8578 (GCVE-0-2015-8578)

CVE-2014-9632 (GCVE-0-2014-9632)

CVE-2010-5152 (GCVE-0-2010-5152)

CVE-2024-6510 (GCVE-0-2024-6510)

CVE-2017-5566 (GCVE-0-2017-5566)

CVE-2015-8578 (GCVE-0-2015-8578)

CVE-2014-9632 (GCVE-0-2014-9632)

CVE-2010-5152 (GCVE-0-2010-5152)