Avira Free Antivirus up to 15.0.2005.1866 Avira.PWM.NativeMessaging.exe insufficiently protected credentials ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Avira Free Antivirus up to 15.0.2005.1866. This issue affects some unknown processing of the file Avira.PWM.NativeMessaging.exe. This manipulation causes insufficiently protected credentials. The identification of this vulnerability is CVE-2020-12680. The attack can only be executed locally. There is no exploit available. The actual existence of this vulnerability is currently in question.

Detailsinfo

A vulnerability has been found in Avira Free Antivirus up to 15.0.2005.1866 (Anti-Malware Software) and classified as problematic. Affected by this vulnerability is an unknown functionality of the file Avira.PWM.NativeMessaging.exe. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. The CWE definition for the vulnerability is CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. As an impact it is known to affect confidentiality. The summary by CVE is:

** DISPUTED ** Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and thus a request such as fetchChromePasswords or fetchCredentials will succeed. NOTE: some third parties have stated that this is "not a vulnerability."

The weakness was shared 05/08/2020. This vulnerability is known as CVE-2020-12680 since 05/06/2020. Attacking locally is a requirement. The successful exploitation needs a single authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• Avira

Name

• Free Antivirus

Version

• 15.0.2005.1866

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion