Security: Avira Optimizer allows privilege escalation

[German]Users of the virus protection solution receive the Avira Optimizer installed in newer versions. Up to the version before 1.2.0.367, this contains a vulnerability that allows privileges escalation. The Avira developers have now fixed this vulnerability with the version mentioned above.


Advertising

Security researcher Matt Nelson noticed this, he tested it under Windows 10 1803 (x64). The following tweet points to the issue caused by insecure named pipes. 

Here’s a rough outline of what this is about. The details can be read in the linked article.

Vulnerability Avira.OptimizerHost.exe service

When the latest Avira antivirus program is installed, it is delivered with various components as standard. One of these components is the Avira Optimizer. In short, “Avira.OptimizerHost.exe” runs as “NT AUTHORITY\SYSTEM” and takes commands from the named pipe “AviraOptimizerHost”:

\\.\pipe\AviraOptimizerHost


Advertising

The service performs an improper validation of the calling client. Added to this are invalid checks on started executables that allow malicious code to create process calls to Avira.OptimizerHost.exe. This can lead to local privilege escalation.

Brief analysis of the problem

Avira.OptimizerHost.exe can communicate with clients via a named pipe. This checks whether the client is an Avira application. Matt Nelson has now found a way to use a fake client with an Avira certificate to communicate with the service provided by Avira.OptimizerHost.exe.

The fake client can then open a command prompt that runs with system privileges thanks to the named pipe and the Avira.OptimizerHost.exe. In this blog post, Matt Nelson discusses here the details of the vulnerability.

Vulnerability already fixed

The Avira development team was contacted by Matt Nelson after he encountered the problem. The team remained in constant contact and solved the problem in a very short time. Within about 30 days of the first report, a fix was developed and distributed to the users. Here is the progress of the process:

  • July 23, 2019: Vulnerability sent to Avira
  • July 24, 2019: Confirmation by Avira, hints of compile problems at PoC
  • July 26 , 2019: Avira can reproduce the problem with the PoC
  • August 6, 2019: Avira provides the first fix and offers a test
  • August 6, 2019: Answer to Avira with a bypass for the patch with updated Proof of Concept (PoC) and details
  • August 16, 2019: Avira presents a new fix and offers a new test
  • August 16, 2019: Fix tested, seems to fix the vulnerability, information to Avira
  • August 27, 2019: Avira distributes the fix to its users

On August 29, 2019, Matt Nelson revealed the details within this blog post.

    Similar articles:
    PUP: AVIRA adds Aviara Launcher to paid version
    AVAST and Avira confirms April 2019 Update issues


    Advertising


    This entry was posted in Security, Windows and tagged , , , , . Bookmark the permalink.

    Leave a Reply

    Your email address will not be published. Required fields are marked *