CVE-2020-15024 : Exploit Details and Defense Strategies

An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation.

Understanding CVE-2020-15024

This CVE identifies a vulnerability in the Password Manager component of Avast Antivirus that could lead to sensitive information exposure due to improper session handling.

What is CVE-2020-15024?

The vulnerability in the Login Password feature of Avast Antivirus 20.1.5069.562 allows stored passwords to remain in Windows main memory post-logout and Lock Vault operation, potentially exposing sensitive information.

The Impact of CVE-2020-15024

The vulnerability could result in unauthorized access to stored passwords, leading to potential information disclosure and compromising user security.

Technical Details of CVE-2020-15024

This section provides technical insights into the vulnerability.

Vulnerability Description

The issue lies in the improper handling of sessions in the Password Manager component, allowing passwords to persist in memory after logout and Lock Vault operations.

Affected Systems and Versions

Product: Avast Antivirus
Version: 20.1.5069.562

Exploitation Mechanism

The vulnerability could be exploited by an attacker with access to the same system to retrieve stored passwords from the Windows main memory.

Mitigation and Prevention

Protecting systems from CVE-2020-15024 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Avast Antivirus to the latest version to patch the vulnerability.
Avoid storing sensitive passwords in the Password Manager until the issue is resolved.

Long-Term Security Practices

Regularly monitor for security updates and apply them promptly.
Use additional layers of security such as multi-factor authentication to enhance protection.
Educate users on secure password management practices to mitigate risks.

Patching and Updates

Ensure that all systems running Avast Antivirus are updated to the latest version to address the vulnerability.