cnvd - cnvd-2016-05112

cnvd-2016-05112

Vulnerability from cnvd

Title: 多款Avast产品安全绕过漏洞

Description:

Avast Internet Security等都是捷克Avast（爱维士）公司的杀毒软件。

多款Avast产品的沙盒中存在安全绕过漏洞。攻击者可利用该漏洞绕过安全限制，执行未授权操作。

Severity: 中

Formal description:

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： http://www.avast.com/

Reference: http://www.securityfocus.com/bid/86925

Impacted products

Name
['Avast Internet Security 11.x.x', 'Avast Avast Pro Antivirus 11.x.x', 'Avast Avast Premier 11.x.x', 'Avast Avast Free Antivirus 11.x.x', 'Avast Business Security 11.x.x', 'Avast Endpoint Protection 8.x.x', 'Avast Endpoint Protection Plus 8.x.x', 'Avast EndpointProtection Suite 8.x.x', 'Avast Endpoint Protection Suite Plus 8.x.x', 'Avast File Server Security 8.x.x', 'Avast Email Server Security 8.x.x']

Name

['Avast Internet Security 11.x.x', 'Avast Avast Pro Antivirus 11.x.x', 'Avast Avast Premier 11.x.x', 'Avast Avast Free Antivirus 11.x.x', 'Avast Business Security 11.x.x', 'Avast Endpoint Protection 8.x.x', 'Avast Endpoint Protection Plus 8.x.x', 'Avast EndpointProtection Suite 8.x.x', 'Avast Endpoint Protection Suite Plus 8.x.x', 'Avast File Server Security 8.x.x', 'Avast Email Server Security 8.x.x']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "86925"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-4025"
    }
  },
  "description": "Avast Internet Security\u7b49\u90fd\u662f\u6377\u514bAvast\uff08\u7231\u7ef4\u58eb\uff09\u516c\u53f8\u7684\u6740\u6bd2\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eAvast\u4ea7\u54c1\u7684\u6c99\u76d2\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002",
  "discovererName": "Kyriakos Economou",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a \r\nhttp://www.avast.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-05112",
  "openTime": "2016-07-21",
  "products": {
    "product": [
      "Avast Internet Security 11.x.x",
      "Avast Avast Pro Antivirus 11.x.x",
      "Avast Avast Premier 11.x.x",
      "Avast Avast Free Antivirus 11.x.x",
      "Avast Business Security 11.x.x",
      "Avast Endpoint Protection 8.x.x",
      "Avast Endpoint Protection Plus 8.x.x",
      "Avast EndpointProtection Suite 8.x.x",
      "Avast Endpoint Protection Suite Plus 8.x.x",
      "Avast File Server Security 8.x.x",
      "Avast Email Server Security 8.x.x"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/86925",
  "serverity": "\u4e2d",
  "submitTime": "2016-07-19",
  "title": "\u591a\u6b3eAvast\u4ea7\u54c1\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2016-4025 (GCVE-0-2016-4025)

Vulnerability from cvelistv5

Published

2016-11-03 10:00

Modified

2024-08-06 00:17

Severity ?

CWE

Summary

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call.

References

▼	URL	Tags
	https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:17:29.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-03T08:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-4025",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/",
              "refsource": "MISC",
              "url": "https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-4025",
    "datePublished": "2016-11-03T10:00:00",
    "dateReserved": "2016-04-14T00:00:00",
    "dateUpdated": "2024-08-06T00:17:29.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted