Code Injection Vulnerability in Avira Total Security and Optimization Suites

CVE-2017-6417

What is CVE-2017-6417?

A code injection vulnerability exists in several versions of Avira Total Security and Optimization Suites, allowing local attackers to exploit a weakness in the self-protection mechanism of these products. By leveraging a 'DoubleAgent' attack, an attacker can bypass protections, inject arbitrary code, and gain control over Avira processes. This vulnerability arises mainly because the affected products do not utilize the Protected Processes feature. Consequently, attackers can manipulate the Image File Execution Options in the Windows registry to load a malicious DLL. The intended self-protection functionality, designed to prevent unauthorized local modifications, can be circumvented, allowing unauthorized access and potential damage.

References