Code Injection Vulnerability in AVG Products by AVG Technologies

CVE-2017-5566

What is CVE-2017-5566?

A code injection vulnerability exists in AVG Ultimate, AVG Internet Security, and AVG AntiVirus FREE that allows local attackers to bypass self-protection mechanisms. By leveraging a 'DoubleAgent' attack, an attacker can inject arbitrary code into any AVG process, thereby gaining full control over it. This vulnerability arises because the affected products do not implement the Protected Processes feature, allowing attackers to manipulate Image File Execution Options in the registry. The self-protection mechanism, originally designed to prevent unauthorized modifications, can be circumvented by temporarily renaming critical registry entries during an attack.

References