cnvd - cnvd-2016-05112

CNVD-2016-05112

Vulnerability from cnvd - Published: 2016-07-21

Title

多款Avast产品安全绕过漏洞

Description

Avast Internet Security等都是捷克Avast（爱维士）公司的杀毒软件。多款Avast产品的沙盒中存在安全绕过漏洞。攻击者可利用该漏洞绕过安全限制，执行未授权操作。

Severity

中

Formal description

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： http://www.avast.com/

Reference

http://www.securityfocus.com/bid/86925

Impacted products

Name
['Avast Internet Security 11.x.x', 'Avast Avast Pro Antivirus 11.x.x', 'Avast Avast Premier 11.x.x', 'Avast Avast Free Antivirus 11.x.x', 'Avast Business Security 11.x.x', 'Avast Endpoint Protection 8.x.x', 'Avast Endpoint Protection Plus 8.x.x', 'Avast EndpointProtection Suite 8.x.x', 'Avast Endpoint Protection Suite Plus 8.x.x', 'Avast File Server Security 8.x.x', 'Avast Email Server Security 8.x.x']

Name

['Avast Internet Security 11.x.x', 'Avast Avast Pro Antivirus 11.x.x', 'Avast Avast Premier 11.x.x', 'Avast Avast Free Antivirus 11.x.x', 'Avast Business Security 11.x.x', 'Avast Endpoint Protection 8.x.x', 'Avast Endpoint Protection Plus 8.x.x', 'Avast EndpointProtection Suite 8.x.x', 'Avast Endpoint Protection Suite Plus 8.x.x', 'Avast File Server Security 8.x.x', 'Avast Email Server Security 8.x.x']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "86925"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-4025"
    }
  },
  "description": "Avast Internet Security\u7b49\u90fd\u662f\u6377\u514bAvast\uff08\u7231\u7ef4\u58eb\uff09\u516c\u53f8\u7684\u6740\u6bd2\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eAvast\u4ea7\u54c1\u7684\u6c99\u76d2\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002",
  "discovererName": "Kyriakos Economou",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a \r\nhttp://www.avast.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-05112",
  "openTime": "2016-07-21",
  "products": {
    "product": [
      "Avast Internet Security 11.x.x",
      "Avast Avast Pro Antivirus 11.x.x",
      "Avast Avast Premier 11.x.x",
      "Avast Avast Free Antivirus 11.x.x",
      "Avast Business Security 11.x.x",
      "Avast Endpoint Protection 8.x.x",
      "Avast Endpoint Protection Plus 8.x.x",
      "Avast EndpointProtection Suite 8.x.x",
      "Avast Endpoint Protection Suite Plus 8.x.x",
      "Avast File Server Security 8.x.x",
      "Avast Email Server Security 8.x.x"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/86925",
  "serverity": "\u4e2d",
  "submitTime": "2016-07-19",
  "title": "\u591a\u6b3eAvast\u4ea7\u54c1\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2016-4025 (GCVE-0-2016-4025)

Vulnerability from cvelistv5 – Published: 2016-11-03 10:00 – Updated: 2024-08-06 00:17

Summary

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://labs.nettitude.com/blog/escaping-avast-sa…

x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:17:29.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-03T08:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-4025",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/",
              "refsource": "MISC",
              "url": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-4025",
    "datePublished": "2016-11-03T10:00:00",
    "dateReserved": "2016-04-14T00:00:00",
    "dateUpdated": "2024-08-06T00:17:29.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-05112

CVE-2016-4025 (GCVE-0-2016-4025)

Tags

Sightings

Nomenclature