1

Attacker can raise access rights via the chest?

Read here: https://bogner.sh/2017/11/avgater-getting-local-admin-by-abusing-the-anti-virus-quarantine/

When will avast patch against this leak? Trend Micro, Emsisoft, Kaspersky Lab, Malwarebytes, ZoneAlarm & Ikarus already did.

polonus

2

Considering that the avast virus chest content is encrypted and the file name is changed (not to mention the self-defence module), I’m at a loss as to how this is gets round this.

3

No, Avast is not vulnerable.
Thanks Polunus for bringing this possible issue.

“From the security perspective, we are OK, as restore is done under user account who requested it, so no privilege escalation is possible”.
“And about the statement about weakening HTTPs security mentioned at the end of the article, I guess we have answered here: https://blog.avast.com/avasts-https-scanner-receives-a-rating”

(from Virus Lab)

4

Thanks polonus for putting “my theme” published in viruses and worms in the right place where it is best seen, thanks Lisandro for clarifying that avast is not vulnerable. :smiley:

regards

https://forum.avast.com/index.php?topic=210805.0