Avast Antivirus up to 24.1 Repair improper validation of specified quantity in input

Summaryinfo

A vulnerability, which was classified as critical, has been found in Avast Antivirus up to 24.1. Affected is an unknown function of the component Repair. The manipulation leads to improper validation of specified quantity in input. This vulnerability is referenced as CVE-2024-5102. The attack can only be performed from a local environment. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Avast Antivirus up to 24.1. It has been rated as critical. This issue affects an unknown functionality of the component Repair. The manipulation with an unknown input leads to a improper validation of specified quantity in input vulnerability. Using CWE to declare the problem leads to CWE-1284. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A sym-linked file accessed via the repair function in Avast Antivirus troubleshooting -> repair) feature, which attempts to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. A low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the system. This can provide a low-privileged user an Elevation of Privilege to win a race-condition which will re-create the system files and make Windows callback to a specially-crafted file which could be used to launch a privileged shell instance. This issue affects Avast Antivirus prior to 24.2.

The weakness was published by Naor Hodorov. It is possible to read the advisory at support.norton.com. The identification of this vulnerability is CVE-2024-5102 since 05/18/2024. The exploitation is known to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 24.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• Avast

Name

• Antivirus

Version

• 24.0
• 24.1

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion