Comodo antivirus server 2012 driver#
Comodo antivirus server 2012 code#

The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle, which triggers a NULL pointer dereference.Ĭomodo GeekBuddy before 4.18.121 does not restrict access to the VNC server, which allows local users to gain privileges by connecting to the server.Ĭomodo Internet Security before 57.2253 on Windows 7 圆4 allows local users to cause a denial of service (system crash) via a crafted 32-bit Portable Executable (PE) file with a kernel ImageBase value.

Comodo antivirus server 2012 code#

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL. This allows an attacker to cause a denial of service (BSOD) when an executable is run inside the container.Ĭomodo Antivirus through 12., Comodo Firewall through 12., and Comodo Internet Security Premium through 12., with the Comodo Container feature, are vulnerable to Sandbox Escape. can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications. This DLL is then loaded into a high-privileged service before the binary signature validation logic is loaded, and might bypass some of the self-defense mechanisms.Ī use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12. A DLL Preloading vulnerability allows an attacker to implant an unsigned DLL named iLog.dll in a partially unprotected product directory. A local process can bypass the signature check enforced by CmdAgent via process hollowing which can then allow the process to invoke sensitive COM methods in CmdAgent such as writing to the registry with SYSTEM privileges.Īn issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. are vulnerable to Local Privilege Escalation due to CmdAgent's handling of COM clients. Cavwp.exe loads Comodo antivirus definition database in unsecured global section objects, allowing a local low privileged process to modify this data directly and change virus signatures.Ĭomodo Antivirus versions up to 12. are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database. This results in CmdVirth.exe and its child svchost.exe instances to terminate.Ĭomodo Antivirus versions up to 12. A low privileged local process can connect to this port and send an LPC_DATAGRAM, which triggers an Access Violation due to hardcoded NULLs used for Source parameter in a memcpy operation that is called for this handler. are vulnerable to a local Denial of Service affecting CmdVirth.exe via its LPC port 'cmdvrtLPCServerPort'.

This section object is exposed by CmdAgent and contains a SharedMemoryDictionary object, which allows a low privileged process to modify the object data causing CmdAgent.exe to crash.Ĭomodo Antivirus versions up to 12. and below are vulnerable to Denial of Service affecting CmdAgent.exe via an unprotected section object '_CisSharedMemBuff'. The crash occurs when the driver performs a memset operation which uses a size beyond the size of buffer specified, causing kernel crash.Ĭomodo Antivirus versions 12. This can trigger an out-of-bounds write if lpOutBuffer parameter in FilterSendMessage API is near the end of specified buffer bounds. Once this occurs, a specially crafted message can be sent to 'cmdServicePort' using 'FilterSendMessage' API. A low privileged process can crash CmdVirth.exe to decrease the port's connection count followed by process hollowing a CmdVirth.exe instance with malicious code to obtain a handle to 'cmdServicePort'. and below are vulnerable to Denial of Service affecting CmdGuard.sys via its filter port 'cmdServicePort'. To escalate privilege, a low-privileged attacker can use an NTFS directory junction to restore a malicious DLL from quarantine into the System32 folder.Ĭomodo Antivirus versions 11.

has a quarantine flaw that allows privilege escalation.