CVE-2020-8961

An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://support.avira.com/hc/en-us/articles/360000109798-Avira-Antivirus-for-Windows	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:avira:free_antivirus:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-04-09 20:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-8961

Mitre link : CVE-2020-8961

CVE.ORG link : CVE-2020-8961

JSON object : View

Products Affected

avira

free_antivirus

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-8961", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-04-09T20:15:12.403", "references": [{"url": "https://support.avira.com/hc/en-us/articles/360000109798-Avira-Antivirus-for-Windows", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Avira Free-Antivirus versiones anteriores a 15.0.2004.1825. La funcionalidad Self-Protection no proh\u00edbe una operaci\u00f3n de escritura desde un proceso externo. Por lo tanto, una inyecci\u00f3n de c\u00f3digo puede ser usada para desactivar esta funci\u00f3n. Despu\u00e9s de eso, se puede construir un evento que modificar\u00e1 un archivo en una ubicaci\u00f3n espec\u00edfica y pasar este evento al controlador, lo cual anular\u00e1 la funcionalidad antivirus."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:avira:free_antivirus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DE32787-5DA0-4BE1-B093-98B479689E49", "versionEndExcluding": "15.0.2004.1825"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}