CVE-2017-5567 in Premier
Summary
by MITRE
Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12.3 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avast process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2024
The CVE-2017-5567 vulnerability represents a critical code injection flaw affecting multiple Avast security products including Premier, Internet Security, Pro Antivirus, and Free Antivirus versions 12.3 and earlier. This vulnerability operates through a sophisticated attack vector known as "DoubleAgent" that exploits fundamental weaknesses in the software's self-protection mechanisms. The flaw specifically targets the absence of Protected Processes feature implementation in these security applications, creating a critical exploit path that allows local attackers to bypass security controls and execute arbitrary code within Avast processes. The vulnerability stems from the software's inability to properly secure registry entries under Image File Execution Options, which are typically used by Application Verifier to inject debugging DLLs into processes.
The technical exploitation mechanism involves an attacker leveraging the absence of Protected Processes to manipulate registry entries that control execution options for Avast processes. This attack bypasses the intended self-protection mechanism that should prevent local processes from modifying Image File Execution Options for security applications. The vulnerability manifests when an attacker temporarily renames the Image File Execution Options registry keys during the attack window, effectively circumventing the protection mechanisms designed to block unauthorized modifications. This technique demonstrates a sophisticated understanding of Windows registry manipulation and process injection techniques that aligns with attack patterns documented in the ATT&CK framework under process injection and registry modification tactics.
From a cybersecurity perspective, this vulnerability represents a significant compromise of the security model for endpoint protection software, as it allows attackers to escalate privileges and gain complete control over security processes. The attack vector specifically targets the fundamental architecture of how security software protects itself from tampering, creating a scenario where the very software designed to defend against threats becomes vulnerable to exploitation. The implications extend beyond simple code injection, as successful exploitation enables attackers to modify core security functionality and potentially establish persistent access to compromised systems. The vulnerability's impact is particularly severe because it affects the core protection mechanisms of antivirus software, potentially allowing attackers to disable security features entirely.
The security implications of CVE-2017-5567 align with CWE-471, which addresses the weakness of "Modification of Assumed-Immutable Data," and demonstrates how attackers can manipulate expected system behaviors to achieve unauthorized access. The vulnerability also reflects attack patterns described in the MITRE ATT&CK matrix under process injection techniques and registry modification methods, specifically targeting the registry keys that control process execution options. Organizations using affected Avast versions face significant risk of complete system compromise, as the vulnerability allows attackers to bypass security controls that should protect against such modifications. The attack requires local system access but provides the attacker with elevated privileges to manipulate security processes, making it particularly dangerous in environments where local access is possible.
Mitigation strategies for this vulnerability require immediate patching of affected Avast products to version 12.3.1 or later, which addresses the registry manipulation bypass issue. Organizations should also implement registry monitoring solutions to detect unauthorized modifications to Image File Execution Options and related security keys. System administrators should consider implementing additional security controls such as registry permissions hardening and process monitoring to prevent unauthorized modifications to critical security registry entries. The vulnerability underscores the importance of Protected Processes implementation in security software and highlights the need for comprehensive protection against registry-based attack vectors. Security teams should also conduct thorough assessments of their endpoint protection configurations to ensure that similar vulnerabilities do not exist in other security products or system components.