Experts discovered several flaws in Comodo Antivirus, including a vulnerability that could allow to escape the sandbox and escalate privileges.
The Tenable expert David Wells discovered five flaws in the Comodo Antivirus and Comodo Antivirus Advanced.
Four of the vulnerabilities affect were version 188.8.131.5210 and one the version 184.108.40.20682.
The most severe flaw, tracked as CVE=2019-3969, could be exploited by an attacker with access to the target system to escape the Comodo Antivirus sandbox and escalate privileges to SYSTEM.
“An attacker can bypass this signing check however by changing the client’s process name within it’s PEB (Process Environment Block), or process hollowing a Comodo/Microsoft signed processes with malicious code. This is because CmdAgent’s signature check uses the filename from EnumProcessModules / GetModuleFilename for the COM Client’s PID. Once passing trusted binary check, an attacker can obtain an Instance of IServiceProvider.” reads the post published by Tenable. “With IServiceProvider, the attacker can then query for an interface to SvcRegKey and perform registry writes through the Out-Of-Proc COM server as “NT AUTHORTIY\SYSTEM”, allowing local privilege escalation.”
Another vulnerability, tracked as, CVE-2019-3970, is an arbitrary file write issue that could be’ exploited by an attacker to modify malware definitions and evade detection.
The remaining issue could be exploited by an attacker with access to the target system to trigger a DoS condition in the kernel and other components. All the flaws were rated As “medium” or “low” severity.
Wells published technical details for the sandbox escape/privilege escalation vulnerability in a post published on Medium.
Tenable reported the flaws to Comodo in April, but at the time of writing the vendor has yet to address them.
“At the time of this disclosure, we are not aware of any patches released by Comodo that address these vulnerabilities. We recommend to keep updated on future Comodo Antivirus releases.” concludes Tenable.
Below the timeline for the flaw:
04/17/19 – Tenable discloses to Comodo.
04/29/19 – Tenable follows up, asking if vulnerabilities have been confirmed.
05/07/19 – Comodo confirms some vulnerabilities, waiting to confirm others.
05/20/19 – Tenabe requests status update.
06/04/19 – Tenabe requests status update.
06/04/19 – Comodo provides status update. No planned release date at this time
06/04/19 – Tenable asks for confirmation of vulnerabilities
06/07/19 – Comodo explains LPE vulnerability is partially due to Microsoft’s fault
06/10/19 – Tenable asks what Microsoft’s fault is in this scenario
06/19/19 – Tenable notifies Comodo that we plan to release CVEs for issues
07/08/19 – Tenable asks when Comodo expects fixes for disclosed issues.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.