translate.avira.com suffers from a cross site scripting vulnerability.
d71d8ff7e41f6aa75bf4b383a4ad84b35a924e19ee1f73dce983f4e1bc088f07Ubuntu Security Notice 4504-1 - Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie-Hellman ciphersuites in the TLS specification and implemented by OpenSSL contained a flaw. A remote attacker could possibly use this issue to eavesdrop on encrypted communications. This was fixed in this update by removing the insecure ciphersuites from OpenSSL. Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL incorrectly handled ECDSA signatures. An attacker could possibly use this issue to perform a timing side-channel attack and recover private ECDSA keys. This issue only affected Ubuntu 18.04 LTS. Various other issues were also addressed.
a453c91247c0c8b05f0a70b1a3674ee04e7e21eea70c71f8885d6de34ed4c9a3The AVIRA parsing engine supports the ISO container format. The parsing engine can be bypassed by specifically manipulating the ISO Archive This leads to the Endpoint ignoring the container and the Gateways to let this file slip through uninspected. Avira does not patch or update their very popular command line scanner that is still available for download on their website. AV Engine versions below 8.3.54.138 are affected.
e3a1a68dae3a544a78b4225ef81e20a998dd5f42a98b27d7f851c97568992124The AVIRA parsing engine can be bypassed by specifically manipulating the ZIP Archive (GPFLag) making the Avira parser believes the file to be encrypted although it isn't. This leads to the Endpoint ignoring the archive and the Avira Gateway Solutions to follow the "File is encrypted" logic.
ac2daf7bcc95857b4f5049cebd3177cbe3381b4badbb37ff3079ae24ed46821aAVIRA engine versions below 8.3.54.138 suffer from a generic bypass vulnerability. The parsing engine supports the ISO container format. The parsing engine can be bypassed by specifically manipulating an ISO container so that it can be accessed by an end-user but not the Anti-Virus software. The AV engine is unable to scan the container and gives the file a "clean" rating.
85c4b06afcbbc9a3f987b258ae2ab7050eaf9660ac992ddb9e1593f4bc088632Avira Free Security Suite 2019 Software Updater version 2.0.6.13175 suffers from an improper access control that allows for arbitrary file write that can allow an unprivileged user to obtain SYSTEM privileges.
69fdf1c757c972b00a6ac38b381268805e095c1577ed18107e11edadd414cc65Debian Linux Security Advisory 4400-1 - Juraj Somorovsky, Robert Merget and Nimrod Aviram discovered a padding oracle attack in OpenSSL.
8b3bd6404f65745161cc6a1873fed7ddf1ec54093e6aa6e4528362789df0c5cdUbuntu Security Notice 3899-1 - Juraj Somorovsky, Robert Merget, and Nimrod Aviram discovered that certain applications incorrectly used OpenSSL and could be exposed to a padding oracle attack. A remote attacker could possibly use this issue to decrypt data.
314dd057e4f3b505847675be956a215758d853b3d9060ea0c5c55356b5e867b6Avira Antivirus versions 15.0.21.86 and below suffer from a command execution vulnerability.
78a59e0dd369a5bd39deaf1ea862d4e542548155f19cd30868dfaf06d9060e7dAvira's free antivirus package installers suffer from a dll hijacking vulnerability.
cd4e84ee068f9e9cfe8d95ea64f7b69bb88001d7158979971fe5682f3df4324dAvira suffers from a heap underflow vulnerability when parsing PE section headers.
ea61070846baddcbb28d0f5d8e2027b479bd9eb7b9a66c93cc181a9f30a48ac3Avira Registry Cleaner suffers from a local DLL hijacking vulnerability.
25dbcc7db394b17559de2ca3d0756be3cb74f12b5d2bde975cdaeb1e15c10f9dAvira Mobile Security versions 1.5.7 and below send credentials in the clear over HTTP.
07268a63a10e9e04ee38ecd991fda216994295c0b1d633261d7e59f97a112f35An independent Vulnerability Laboratory Researcher discovered a cross site request forgery vulnerability in the official Avira license account system web-application.
ab4176d2b30b9e05afdd30da7c3b895224608b39c04f1ce77d350aa5b6774188Avira Secure Backup version 1.0.0.1 build 3616 suffers from a buffer overflow vulnerability.
8a2c729190e444854e9eea2ba4a3bf9fc83b7990ca632fb6cff00b8e685190a9Avira Internet Security filter bypass and privilege escalation zero day exploit that leverages avipbb.sys.
702acd4605649bdfd7902b0361aaa3f3d45c394a3a485490013d98e89acbc84fAvira Analysis Web Service suffers from a remote SQL injection vulnerability.
b3027710b6c99a1596e86ed291f5ab4b8ddd1efb8e6a7331dbc90080704db339Avira AntiVir Engine versions prior to 8.2.12.58 suffers from filter evasion and denial of service vulnerabilities.
f5e46b03133d76cb79b53518f4dfe1360eac24c598dd82d32a8f7e0fd3a49db7The Avira License website suffers from a cross site scripting vulnerability.
8bb687fa151c985c2f05445764729ac43a262520f24363ccb4710dc9701b935fAvira Personal appears to suffer from a privilege escalation vulnerability.
eaf724f00a57c953aa68cb8bf5bf660c22076238cbf4e3a71e4f2c63cd81df8aDemonstration DLL hijacking code for Avira AntiVir Personal version 10.00.12, Free YouTube Download version 2.10, HTTrack Website Copier version 3.44, and Remote Desktop Connection.
def38d921bc8a88a0559e9f2a9b6862a70f8ccfe01d99bded4e903c9f6bb8987This paper offers incremental research in the area of untrusted program input via synchronization handle manipulations. Unlike the Michal Zalewski paper on Delivering Signals for Fun and Profit, this paper focuses on the source of the Unix signal handlers. Tested were personal computers running Windows XP and Vista. The synchronization objects were mutexes and events, and the security software included products from AVG, Avast, Avira, BitDefender, BullGuard, CheckPoint, Eset, F-Prot, F-Secure, Kaspersky, McAfee, Microsoft (Security Essentials), Nor- man, Norton, Panda, PC Tools, Quick Heal, Symantec, and Trend Micro.
18409a8b03683d7197b587b4852f899980f92cd46bb417ee6903700ce8d70d62Avira AntiVirus local proof of concept exploit that creates a malicious QUA file.
e2ef3c0258d84a42617b7cddadf0129c7b654cd36d3ad3612bbf696e8749f11fSecunia Security Advisory - A vulnerability has been discovered in Avira Premium Security Suite, which can be exploited by malicious, local users to cause a DoS (Denial of Service).
3d5f54fd3aca842153c7d5121513f037e2f5c99050ad8dc9d1d931efc95f1c95The avipbb.sys kernel driver distributed with Avira Premium Security Suite contains a race condition vulnerability in the handling parameters of NtCreatekey function. Proof of concept included.
c7a322a2c2f49b80da7890160c04b2a4cf83452613be02530e2c277ec67dba34Avira Premium version 9.0.0.420 DLL hijacking exploit.
107b1d5d2cd123d719f32f834908d80ae41afd12c84b83a5683a34ba50443b50
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed