AVG, McAfee, Kaspersky Antiviruses All Had a Common Bug (softpedia.com)

Posted by timothy on Thursday December 10, 2015 @06:52AM from the fall-together dept.

An anonymous reader writes: Basic ASLR was not implemented in 3 major antivirus makers, allowing attackers to use the antivirus itself towards attacking Windows PCs. The bug, in layman terms, is: the antivirus would select the same memory address space every time it would run. If attackers found out the memory space's address, they could tell their malicious code to execute in the same space, at the same time, and have it execute with root privileges, which most antivirus have on Windows PCs. It's a basic requirement these days for software programmers to use ASLR (Address Space Layout Randomization) to prevent their code from executing in predictable locations. Affected products: AVG, McAfee, Kaspersky. All "quietly" issued fixes.

2 of 132 comments (clear)

Min score:

Reason:

Sort:

Not a major bug by Anonymous Coward · 2015-12-10 07:00 · Score: 3, Interesting

ASLR is what you fall back on when all your primary defenses are shot - the equivalent of not closing the blinds rather than leaving a window open.
That was brought up at Kiwicon a year ago by SumDog · 2015-12-10 07:42 · Score: 5, Interesting

This issue was bought up at Kiwicon a year ago. Some pen-tester showed that a majority of anti-virus software doesn't use ASLR. Furthermore, he shows buffer-overflows and other memory errors in most of their scanners! You could infect most systems with the right malformed PDF or JPEG. It just needed to be scanned. The scanners themselves often run as the system user!
Virus scanners are pretty much worse than useless. They're an attack vector.