A vulnerability was found in Comodo Antivirus up to 12.0.0.6810 (Anti-Malware Software) and classified as problematic. This issue affects an unknown part of the file CmdVirth.exe. The manipulation of the argument Source as part of a Parameter leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. The summary by CVE is:

Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to a local Denial of Service affecting CmdVirth.exe via its LPC port "cmdvrtLPCServerPort". A low privileged local process can connect to this port and send an LPC_DATAGRAM, which triggers an Access Violation due to hardcoded NULLs used for Source parameter in a memcpy operation that is called for this handler. This results in CmdVirth.exe and its child svchost.exe instances to terminate.

The weakness was released 07/17/2019. The identification of this vulnerability is CVE-2019-3971 since 01/03/2019. An attack has to be approached locally. A simple authentication is necessary for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/01/2023).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-138280, VDB-138279, VDB-138283 and VDB-138282.

Productinfo

Type

• Anti-Malware Software

Vendor

• Comodo

Name

• Antivirus

Version

• 12.0.0.6810

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion