Norton Security Advisories

Security Advisories --> Hall Of Fame

 

NLOKSA1516 Time-of-check to time-of-use (TOCTOU) can lead to local privilege escalation
Advisory Status CLOSED
Summary The aswSnx.sys driver contains a time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.
Affected Products Avast/AVG Antivirus 23.8
Issues Mitigation

The issue was fixed with Avast/AVG Antivirus version 23.9.

Acknowledgements

Wei Sheng Teo of Ensign InfoSecurity
CVE-2023-5760  
Severity/CVSSv3 Severity: Low
Score: 8.2
Vector: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References https://nvd.nist.gov/vuln/detail/CVE-2023-5760
Impact Escalation of privelage
Description A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.
Additional Recommendations, if any: We encourage customers to ensure their security software is always updated to the latest version available.
NLOKSA1515 Integer Overflow Local Privilege Escalation Vulnerability
Advisory Status CLOSED
Summary A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could corrupt the data on the heap and lead to a denial-of-service situation
Affected Products Avira Antivirus for Windows Endpointprotection.exe version before 1.0.2303.633
Issues Mitigation

Issue was fixed with Endpointprotection.exe version 1.0.2303.633 released on 03-04-2023. All users will receive the update automatically, no user action is required

Acknowledgements

Rac working with Trend Micro Zero Day Initiative
ZDI-CAN-19836
CVE-2023-1900  
Severity/CVSSv3 Severity: High
Score: 7.8
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 
References https://nvd.nist.gov/vuln/detail/CVE-2023-1900
Impact Integer Overflow Local Privilege Escalation Vulnerability
Description A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could corrupt the data on the heap and lead to a denial-of-service situation.  Issue was fixed with Endpointprotection.exe version 1.0.2303.633
Additional Recommendations, if any: We encourage customers to ensure their security software is always updated to the latest version available.
NLOKSA1511 Avira Security for Windows - Denial of Service
Advisory Status CLOSED
Summary Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service
Affected Products Avira Security for Windows up to version 1.1.77
Issues Mitigation

Upgrade Avira Security for Windows to version 1.1.78. This version was released on 22 November 2022 to all customers. All users received the update automatically and do not need to take any action.

Acknowledgements

YangHao / https://github.com/yanghaoi
CVE-2022-4429  
Severity/CVSSv3 Severity: Medium
Score: 5.3
Vector: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H&version=3.1
References https://nvd.nist.gov/vuln/detail/CVE-2022-4429
Impact Denial of Service
Description Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service
The issue was fixed with Avira Security version 1.1.78
Additional Recommendations, if any: We encourage customers to ensure their security software are always updated to the latest version available.
NLOKSA1510 Norton, Avira, Avast and AVG Antivirus for Windows Privilege Escalation
Advisory Status CLOSED
Summary Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Affected Products Norton Antivirus Windows Eraser Engine Prior to 119.1.5.1
Avira Security for Windows Prior to version 1.1.78
Avast Antivirus Windows Prior to versions 22.10
AVG Antivirus Windows Prior to versions 22.10
Issues Mitigation

Norton Antivirus: Run LiveUpdate, Updates to ERASER Engine 119.1.5.1, dated October 5th, 2022, or greater
Avira Antivirus: Upgrade Avira Security for Windows to version 1.1.78. This version was released on 22 November 2022 to all customers. All users received the update automatically and do not need to take any action.
Avast and AVG Antivirus: Upgrade Avast and AVG Antivirus for Windows to version 22.10 released on 20 October 2022. By default, users of the affected versions should receive the update automatically, they only need to restart Windows to apply the update once Avast / AVG asks them to do so

Acknowledgements

Bahaa Naamneh, Crosspoint Labs
CVE-2022-4294  
Severity/CVSSv3 Severity: High
Score: 7.1
Vector: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H&version=3.1
References https://nvd.nist.gov/vuln/detail/CVE-2022-4294
Impact Privilege Escalation
Description Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. The issue was fixed with Avast and AVG Antivirus version 22.10, Norton Antivirus ERASER Engine 119.1.5.1 and Avira Security version 1.1.78
Additional Recommendations, if any: We encourage customers to ensure their security software are always updated to the latest version available.
NLOKSA1509 Aswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruption
Advisory Status CLOSED
Summary From October 6, 2022 to October 8, 2022, Avast Antivirus windows (Script Shield component versions 18.0.1473.0 and older) caused a crash of the Mozilla Firefox browser due to heap corruption occurring when the Avast DLL library was loaded. Avast and Mozilla have since been working together to mitigate the issue. Avast issued an update to its software on October 8, 2022, to version 18.0.1478. No user action is required as users received this update automatically.
Affected Products Script Shield component versions 18.0.1473.0 and older
Issues Mitigation

Avast issued an update to its Script Shield software on October 8, 2022, to version 18.0.1478. No user action is required as users received this update automatically.

Acknowledgements

Mozilla
CVE-2022-4291  
Severity/CVSSv3 Severity: High
Score: 7.7
Vector: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L/RL:O/RC:R
References https://crash-stats.mozilla.org/report/index/926cf73c-7bdd-4774-a094-1e9f60221008
https://nvd.nist.gov/vuln/detail/CVE-2022-4291
Impact Heap Corruption
Description The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.
Additional Recommendations, if any: We encourage customers to ensure their security software – as well as their tech devices – are always updated to the latest version available.
NLOKSA1508 Avast and AVG Antivirus for Windows vulnerable to Privilege Escalation
Advisory Status CLOSED
Summary Avast has released an update to address an issue that was discovered in the malware removal functionality of Avast and AVG Antivirus.
Affected Products Avast Antivirus - up to version 22.9, starting with version 20.5
AVG Antivirus - up to version 22.9, starting with version 20.5
Issues Mitigation

Upgrade Avast and AVG Antivirus for Windows to version 22.10 released on 20 October 2022. By default, users of the affected versions should receive the update automatically, they only need to restart Windows to apply the update once Avast / AVG asks them to do so.

Acknowledgements

Or Yair / https://www.safebreach.com
https://www.linkedin.com/in/or-yair
https://twitter.com/oryair1999

CVE-2022-4173  
Severity/CVSSv3 Severity: High
Score: 7.3
Vector: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References https://nvd.nist.gov/vuln/detail/CVE-2022-4173
Impact Privilege Escalation
Description A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avast and AVG Antivirus version 22.10.
Additional Recommendations, if any: We encourage customers to ensure their security software are always updated to the latest version available.
NLOKSA1507 Software Updater of Avira Security for Windows vulnerable to Privilege Escalation
Advisory Status CLOSED
Summary NortonLifeLock has released an update to address an issue that was discovered in the software updater functionality of Avira Security.
Affected Products "Avira Security" – for Windows; up to version 1.1.71.30554
Issues Mitigation

Upgrade Avira Security for Windows to version 1.1.72.30556. This version was released on 15. August 2022 to all customers. All users received the update automatically and do not need to take any action.

Acknowledgements

Filip Dragovic

CVE-2022-3368  
Severity/CVSSv3 High
Score: 7.3
Vector: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References Filip Dragovic
Impact Privilege Escalation
Description A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.
Additional Recommendations, if any: We encourage customers to ensure their security software – as well as their tech devices – are always updated to the latest version available.
NLOKSA1506 Avira Password Manager-Browser Extensions vulnerable to Sensitive Data Leakage via Phishing
Advisory Status CLOSED
Summary NortonLifeLock has released an update to address an issue that was discovered in Avira Password Manager Browser Extension
Affected Products Only the following software is affected:
  • "Avira Password Manager" - extension for Chrome; version 2.18.4.3868
  • "Avira Password Manager" - extension for MS Edge; version 2.18.4.3847
  • "Avira Password Manager" - extension for Opera; version 2.18.4.3847
  • "Avira Password Manager" - extension for Firefox; version 2.18.4.38471
  • "Avira Password Manager" - extension for Safari; version 2.18.4
Issues Mitigation

Upgrade extensions to following versions:

  • "Avira Password Manager" - extension for Chrome; version 2.18.5.3877
  • "Avira Password Manager" - extension for MS Edge; version 2.18.5.3877
  • "Avira Password Manager" - extension for Opera; version 2.18.5.3877
  • "Avira Password Manager" - extension for Firefox; version 2.18.5.38771
  • "Avira Password Manager" - extension for Safari; version 2.18.5 (3877)

Users who have not disabled auto-updates receive the updated versions automatically and do not need to take any action

Acknowledgements

Stiftung Warentest

CVE-2022-28795  
Severity/CVSSv3 Critical
Score: 9.6
Vector: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References https://nvd.nist.gov/vuln/detail/CVE-2022-28795
Impact Sensitive Data Leakage
Description A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.
Additional Recommendations, if any: We encourage customers to ensure their security software - as well as their tech devices - are always updated to the latest version available. In addition, we encourage users to use two-factor (2FA) authentication as an additional layer of security.