Multiple Avira Products 'Avipbb.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

Bugtraq ID:	63466
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 20 2013 12:00AM
Updated:	Oct 20 2013 12:00AM
Credit:	Ahmad Moghimi
Vulnerable:	AVIRA Ultimate Protection Suite 14.0 AVIRA Professional Security 14.0 AVIRA Internet Security 14 AVIRA Free Antivirus 14.0 AVIRA Family Protection Suite 14.0 AVIRA Antivirus Suite 14.0
Not Vulnerable:

Multiple Avira Products 'Avipbb.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

Multiple Avira products are prone to a local privilege-escalation vulnerability due to a buffer-overflow condition.

Local attackers can exploit this issue to execute arbitrary code with SYSTEM privileges and completely compromise the affected computer. Failed exploit attempts will result in a denial-of-service condition.

Avira Internet Security 14 is vulnerable; other versions may also be affected.

Multiple Avira Products 'Avipbb.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

The researcher has created an exploit code to demonstrate the issue. Please see the references for more information.

Multiple Avira Products 'Avipbb.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Multiple Avira Products 'Avipbb.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

References:

• Another journey to antivirus escalation (Bypassing Driver Filters) (mallocat)
  
• Avira Homepage (Avira)
  
• Generic windows local pool exploitation (mallocat)