I use Avast Home and noticed that upon installing Avast creates insecure permissions in the program directory that can allow any user to gain administrative access on the machine. Avast gives “BUILTIN\Everyone” full control of just about every file under the program directory. This includes the executables that are executed by the system as services. To gain admin access, a regular use need only replace the one of the Avast executables that run as a system service with a trojan, and reboot the machine.
I emailed to Avast support but got no reply.
You can fix this problem by resetting the permissions of the files under the avast program directory to the defaults, which only give regular users read-only rights.
First of all, welcome and thanks for posting.
Maybe I’m wrong but this:
cannot be done by a regular user, only an user with administrator rights could change that and, this one, could done almost everything as he has rights for…
Yes, I can confirm the problem - it’s an unfortune mistake regarding the file extraction (btw, if your TEMP folder is on a different drive than your avast! installation folder, you won’t be affected).
The problem will be corrected in the next avast! update.
But as far as i can tell avast! checks integrity of critical program files (i know coz i wanted to replace some icon and it warned me right away).
Haven’t tested how it works after fresh boot…
If you are a home user, and run as a regular user (I do), a peice of malware would have to specifically target Avast. As it is 98% of Windows users run as admin anyway, and malware assumes these permissions when it runs. The chances of this issue being exploited are very small IMO.
One place where I would be a little concerned is in business or educational settings (If this issue affects the pro version), where computers are locked down. For example, at a school that uses Avast on it’s lab computers an enterprising student could gain admin rights to a lab machine, or even a server depending on how things are set up.
To fix this issue:
If you are running Windows XP Pro:
Make sure simple file sharing is turned off.
To turn simple file sharing off, open up an Explorer window (My Computer will do), click on “folder options”, click on the “view” tab and uncheck the box that says “Use Simple File Sharing”. This will allow you to view file permissions for files and folder
Browse to your avast program directory (e.g. c:\program files\Alwil Software)
Right-click on the folder, select “properties” from the menu and then click on the “Security” tab
Click on the “Advanced” button
Click on the checkbox that says “Replace permission entries on all child objects with entries shown here that apply to child objects”
Click “Apply” and then “Yes” to the prompt
You may want to turn simple file sharing back on after you are done.
If you are running Windows XP Home:
Restart your computer and start Windows in “Safe Mode”, by pressing F8 before Windows loads.
Log in as “Administrator” (You must log in as the built in administrator account to view file permissions in XP Home)
Browse to your avast program directory (e.g. c:\program files\Alwil Software)
Right-click on the folder, select “properties” from the menu and then click on the “Security” tab
Click on the “Advanced” button
Click on the checkbox that says “Replace permission entries on all child objects with entries shown here that apply to child objects”
Click “Apply” and then “Yes” to the prompt
For XP Home users, instead of starting in safe mode, you can also install the program “ACLView”. It allows you to modify file/folder permissions without having to start up in safe mode. I can’t tell you how to reset the permission with ACLView though, because I’ve havn’t actually used it.
Thank you for reporting this problem to Alwil now they can fix it and make avast! even better and more secure. If Symantec had this problem I would bet that they would not listen, or they would update it in the next major release (about once a year) and charge you money to upgrade it. That is IMHO.
Also one of the links from that Secunia page show avast isn’t alone in this Privilege Escalation issue, thankfully Igor notes it will be corrected in the next avast update; toadlife give us a work around for those that feel it warrants it, thanks for your efforts.
