Avira Antivirus Engine up to 8.3.36 Section Header PE File memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Avira Antivirus Engine up to 8.3.36. This impacts an unknown function of the component Section Header Handler. This manipulation as part of PE File causes memory corruption. This vulnerability is registered as CVE-2016-10402. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Avira Antivirus Engine up to 8.3.36 (Anti-Malware Software) and classified as critical. Affected by this vulnerability is some unknown functionality of the component Section Header Handler. The manipulation as part of a PE File leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow.

The bug was discovered 03/16/2016. The weakness was published 07/27/2017 by Tavis Ormandy (Website). It is possible to read the advisory at bugs.chromium.org. This vulnerability is known as CVE-2016-10402 since 07/27/2017. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 498 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 8.3.36.60 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 84841†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• Avira

Name

• Antivirus Engine

Version

• 8.3.0
• 8.3.1
• 8.3.2
• 8.3.3
• 8.3.4
• 8.3.5
• 8.3.6
• 8.3.7
• 8.3.8
• 8.3.9
• 8.3.10
• 8.3.11
• 8.3.12
• 8.3.13
• 8.3.14
• 8.3.15
• 8.3.16
• 8.3.17
• 8.3.18
• 8.3.19
• 8.3.20
• 8.3.21
• 8.3.22
• 8.3.23
• 8.3.24
• 8.3.25
• 8.3.26
• 8.3.27
• 8.3.28
• 8.3.29
• 8.3.30
• 8.3.31
• 8.3.32
• 8.3.33
• 8.3.34
• 8.3.35
• 8.3.36

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion