what you don't know can hurt you

F-Secure AV Man-In-The-Middle

F-Secure AV Man-In-The-Middle
Posted Mar 10, 2017
Authored by Martin Kolarik

F-Secure AV suffers from an issue where remote code execution under SYSTEM can take place due to a man-in-the-middle vulnerability.

tags | advisory, remote, code execution
advisories | CVE-2016-9892
MD5 | 90b976c461ad98bd893ac4a2de43e0d1

F-Secure AV Man-In-The-Middle

Change Mirror Download
CVE-2017-6466 - Remote Code Execution under SYSTEM via MITM in F-Secure AV

Title: Remote Code Execution under SYSTEM via MITM in F-Secure AV
CVE: CVE-2016-9892
Vendor: F-Secure
Product: All products that include the software updater component
Publication Date: 2017-03-08
Fix: Not available - the vendor does not see this as a security problem
Discoverer: Martin Kolarik (@MaKolarik)

Software Updater is a component used to download and install updates for
operating system and many 3rd party software products (a complete list can
found at
It downloads installation packages over HTTP protocol, with little or no
verification after downloading, and subsequently executes them under SYSTEM
account. This allows a remote attacker who can modify the packages during
downloading to gain a complete control of a target system.

Technical details
Software Updater can be configured in two ways:
a) Manual installation (default). System administrator logged into
F-Secure Policy Manager Console can inspect a list of all available
updates for managed computers, and select which updates will be
installed. In this case, there is absolutely no verification after
downloading and packages can be replaced with any executable.

b) Automatic installation. Updates are downloaded and installed
automatically when they become available. In this case, an option to
only install signed packages is on by default. If this option is on,
packages without signature are not installed automatically; instead,
the installation command has to be issued manually from the Policy
Manager Console (as if auto-updates were not enabled at all). Since
not all vendors sign their packages, it is also possible to turn
this verification off via Policy Manager Console.

Even allowing only signed packages does not provide almost any
protection, because the only thing Software Updater checks is if the
package has a signature. It does not check by whom it was signed, nor
when it was signed, so it is possible to replace it with any other
executable, as long as it is also signed. In case the attacker is not
able to sign their own code directly, they can use this vulnerability
to install any publicly available software signed by its vendor, and
subsequently exploit a vulnerability in that software instead.
Login or Register to add favorites

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    32 Files
  • 25
    Nov 25th
    9 Files
  • 26
    Nov 26th
    11 Files
  • 27
    Nov 27th
    15 Files
  • 28
    Nov 28th
    9 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2020 Packet Storm. All rights reserved.

Security Services
Hosting By