CVE-2019-3973 : Security Advisory and Response

Comodo Antivirus versions 11.0.0.6582 and below are vulnerable to a Denial of Service (DoS) attack on CmdGuard.sys via the filter port "cmdServicePort". An attacker with low privileges can exploit this vulnerability to crash the system and potentially execute malicious code.

Understanding CVE-2019-3973

Versions 11.0.0.6582 and earlier of Comodo Antivirus have a critical vulnerability that can lead to a DoS attack.

What is CVE-2019-3973?

CVE-2019-3973 is a vulnerability in Comodo Antivirus versions 11.0.0.6582 and below that allows attackers to trigger a DoS attack on the system.

The Impact of CVE-2019-3973

This vulnerability can be exploited by attackers to crash the system and potentially execute malicious code, leading to a DoS condition.

Technical Details of CVE-2019-3973

Comprehensive technical information about the vulnerability.

Vulnerability Description

The vulnerability in Comodo Antivirus allows attackers to crash the system via a specially crafted message to "cmdServicePort" using the "FilterSendMessage" API.
An out-of-bounds write can be triggered if specific conditions are met, leading to a kernel crash.

Affected Systems and Versions

Product: Comodo Antivirus
Versions affected: 11.0.0.6582 and below

Exploitation Mechanism

Attackers with low privileges can crash the system by manipulating the connection count of the port and launching malicious code-infused instances.
Process hollowing is used to gain a handle to "cmdServicePort" and trigger the vulnerability.

Mitigation and Prevention

Steps to mitigate and prevent exploitation of CVE-2019-3973.

Immediate Steps to Take

Update Comodo Antivirus to a patched version that addresses the vulnerability.
Monitor system logs for any suspicious activities that could indicate an ongoing attack.

Long-Term Security Practices

Regularly update antivirus software and security patches to prevent known vulnerabilities.
Implement least privilege access controls to limit the impact of potential attacks.

Patching and Updates

Apply security updates and patches provided by Comodo Antivirus to fix the vulnerability and enhance system security.