CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 1CVE-2019-14694
https://notcve.org/view.php?id=CVE-2019-14694
A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications. This allows an attacker to cause a denial of service (BSOD) when an executable is run inside the container. Se puede desencadenar un fallo use-after-free en el contenedor sandbox implementado en cmdguard.sys en Comodo Antivirus 12.0.0.6870 debido a una condición de carrera al manejar solicitudes IRP_MJ_CLEANUP en el minifiltro para notificaciones de cambio de directorio. Esto permite que un atacante provoque una denegación de servicio (BSOD) cuando se ejecuta un ejecutable dentro del contenedor. • http://rce4fun.blogspot.com/2019/08/comodo-antivirus-sandbox-race-condition.html https://github.com/SouhailHammou/Exploits/blob/master/CVE-2019-14694%20-%20Comodo%20AV%20Sandbox%20Race%20Condition%20UAF/comodo_av_uaf_poc.c • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1CVE-2019-14270
https://notcve.org/view.php?id=CVE-2019-14270
Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox Escape. Comodo Antivirus hasta la versión 12.0.0.6870, Comodo Firewall hasta la versión 12.0.0.6870, y Comodo Internet Security Premium hasta la versión 12.0.0.6870, con la característica Comodo Container, son vulnerables a un escape del Sandbox. • https://gaissecurity.com/yazi/discovery-of-sandbox-escape-on-comodo-container-antivirus-amp-firewall •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-11230
https://notcve.org/view.php?id=CVE-2019-11230
In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink. The next time the product attempts to write to the log file, the target of the symlink is renamed. This defect can be exploited to rename a critical product file (e.g., AvastSvc.exe), causing the product to fail to start on the next system restart. En Avast Antivirus antes de 19.4, un administrador local puede engañar al producto para que cambie el nombre de los archivos arbitrarios al reemplazar el archivo Logs \ Update.log con un enlace simbólico. La próxima vez que el producto intente escribir en el archivo de registro, se cambiará el nombre del destino del enlace simbólico. • http://www.mcerlane.co.uk/CVE-2019-11230 http://www.securityfocus.com/bid/109344 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-3973
https://notcve.org/view.php?id=CVE-2019-3973
Comodo Antivirus versions 11.0.0.6582 and below are vulnerable to Denial of Service affecting CmdGuard.sys via its filter port "cmdServicePort". A low privileged process can crash CmdVirth.exe to decrease the port's connection count followed by process hollowing a CmdVirth.exe instance with malicious code to obtain a handle to "cmdServicePort". Once this occurs, a specially crafted message can be sent to "cmdServicePort" using "FilterSendMessage" API. This can trigger an out-of-bounds write if lpOutBuffer parameter in FilterSendMessage API is near the end of specified buffer bounds. The crash occurs when the driver performs a memset operation which uses a size beyond the size of buffer specified, causing kernel crash. • https://www.tenable.com/security/research/tra-2019-34 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-3972
https://notcve.org/view.php?id=CVE-2019-3972
Comodo Antivirus versions 12.0.0.6810 and below are vulnerable to Denial of Service affecting CmdAgent.exe via an unprotected section object "<GUID>_CisSharedMemBuff". This section object is exposed by CmdAgent and contains a SharedMemoryDictionary object, which allows a low privileged process to modify the object data causing CmdAgent.exe to crash. Comodo Antivirus versiones 12.0.0.6810 y anteriores, son vulnerables a una Denegación de Servicio que afecta al archivo CmdAgent.exe por medio de un objeto de sección desprotegida de "(GUID)_CisSharedMemBuff". Este objeto de sección está expuesto mediante CmdAgent y contiene un objeto SharedMemoryDictionary, que permite que un proceso poco privilegiado modifique los datos del objeto que causan que el archivo CmdAgent.exe se bloquee. • https://www.tenable.com/security/research/tra-2019-34 • CWE-125: Out-of-bounds Read •