CVE-2017-5567: Code Injection
Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12.3 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avast process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5567?
CVE-2017-5567 is considered a critical vulnerability due to its ability to allow local attackers to execute arbitrary code.
How do I fix CVE-2017-5567?
To fix CVE-2017-5567, users should update their Avast software to versions later than 12.3.
What software is affected by CVE-2017-5567?
CVE-2017-5567 affects Avast Free Antivirus, Internet Security, Premier, and Pro Antivirus all at version 12.3 and earlier.
Can CVE-2017-5567 be exploited remotely?
No, CVE-2017-5567 requires local access to the machine to exploit the vulnerability.
What types of attacks can be conducted using CVE-2017-5567?
Exploitation of CVE-2017-5567 can lead to arbitrary code execution and complete control over the affected Avast security software.