CVE-2017-5567 : Vulnerability Insights and Analysis

A vulnerability has been discovered in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12.3 (and earlier), allowing a local attacker to circumvent a self-protection mechanism, inject arbitrary code, and gain complete control over any Avast process using a "DoubleAgent" attack.

Understanding CVE-2017-5567

This CVE involves a code injection vulnerability in various Avast products that enables attackers to exploit a self-protection mechanism.

What is CVE-2017-5567?

The vulnerability in Avast products allows local attackers to inject code and take control of Avast processes through a specific attack technique known as "DoubleAgent".

The Impact of CVE-2017-5567

The vulnerability permits attackers to bypass security measures, inject malicious code, and potentially compromise the integrity of Avast antivirus processes.

Technical Details of CVE-2017-5567

This section provides detailed technical insights into the vulnerability.

Vulnerability Description

The flaw enables attackers to bypass the self-protection mechanism in Avast products, injecting arbitrary code to manipulate Avast processes.

Affected Systems and Versions

Avast Premier 12.3 and earlier
Avast Internet Security 12.3 and earlier
Avast Pro Antivirus 12.3 and earlier
Avast Free Antivirus 12.3 and earlier

Exploitation Mechanism

Attackers exploit the absence of the Protected Processes feature in the products
Insert an Application Verifier Provider DLL through the Image File Execution Options in the registry
Bypass the self-protection mechanism by temporarily renaming Image File Execution Options during the attack

Mitigation and Prevention

Protecting systems from CVE-2017-5567 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Avast products to the latest versions available
Implement security best practices to prevent unauthorized access to the registry

Long-Term Security Practices

Regularly monitor and audit registry changes
Educate users on safe computing practices to prevent unauthorized system modifications

Patching and Updates

Avast has likely released patches addressing this vulnerability
Regularly check for updates and apply them promptly to ensure system security