¡¾Îó²îͨ¸æ¡¿Avast & AVG Antivirus´úÂëÖ´ÐÐÎó²î£¨CVE-2022-26522£©

Ðû²¼Ê±¼ä 2022-05-06


0x00 Îó²î¸ÅÊö

2022Äê5ÔÂ5ÈÕ£¬£¬£¬£¬£¬£¬SentinelLabs µÄÑо¿Ö°Ô±¹ûÕæÁËÔÚ Avast ºÍ AVG£¨2016 Äê±» Avast ÊÕ¹º£©·À²¡¶¾½â¾ö¼Æ»®Ê¹ÓõÄÇý¶¯³ÌÐòÖз¢Ã÷µÄ2¸ö±£´æ¶àÄêµÄÇå¾²Îó²î¡£¡£¡£¡£¡£¡£¡£

 

0x01 Îó²îÏêÇé

AvastÊÇÈ«Çò×ÅÃûµÄɱ¶¾Èí¼þ£¬£¬£¬£¬£¬£¬ÔÚÍâÑóÊг¡Ò»Ö±´¦ÓÚÁìÏÈְλ¡£¡£¡£¡£¡£¡£¡£

Ñо¿Ö°Ô±·¢Ã÷µÄÎó²î»®·ÖΪCVE-2022-26522 ºÍ CVE-2022-26523£¬£¬£¬£¬£¬£¬ÔÚÓÚÃûΪ aswArPot.sys µÄanti-rootkitÄÚºËÇý¶¯³ÌÐòÖУ¬£¬£¬£¬£¬£¬ËüÊÇÓÉ AVAST Software ¾ÙÐÐÊý×ÖÊðÃûµÄ¡°Avast anti-rootkit¡±¡£¡£¡£¡£¡£¡£¡£

ÏêϸÀ´Ëµ£¬£¬£¬£¬£¬£¬¸ÃÎó²îµÄȪԴÔÚÓÚÄÚºËÇý¶¯³ÌÐòÖеÄÒ»¸öÌ×½Ó×ÖÅþÁ¬´¦Öóͷ£³ÌÐò£¬£¬£¬£¬£¬£¬Ëü¿ÉÄܵ¼Ö·ÇÖÎÀíÔ±Óû§ÔÚÄÚºËÖÐÔËÐдúÂë¶øÊµÏÖȨÏÞÉý¼¶£¬£¬£¬£¬£¬£¬¿ÉÄܵ¼Ö²Ù×÷ϵͳÍ߽ⲢÏÔʾÀ¶ÆÁËÀ»ú£¨BSoD£©¹ýʧ¡£¡£¡£¡£¡£¡£¡£¿£¿£¿ÉÒÔʹÓÃÕâЩÎó²îÔÚûÓÐÌØÈ¨µÄÇéÐÎÏÂÔÚÄÚºËģʽÏÂÖ´ÐдúÂ롢ʵÏÖɳÏäÌÓÒÝ¡¢ÈƹýÇå¾²²úÆ·µÈ£¬£¬£¬£¬£¬£¬²¢¿ÉÄÜÍêÈ«½ÓÊÜ×°±¸¡£¡£¡£¡£¡£¡£¡£

ËäÈ»¸ÃÎó²îÏÖÔÚÉÐδ·¢Ã÷±»Ê¹Ó㬣¬£¬£¬£¬£¬µ«¸ÃÇý¶¯³ÌÐòÊÇÔÚ 2012 Äê 6 Ô嵀 Avast °æ±¾ 12.1 ÖÐÒýÈëµÄ£¬£¬£¬£¬£¬£¬ÕâÒâζ×ÅÎó²îÒѾ­±£´æÁ˽ü10Äê £¬£¬£¬£¬£¬£¬²¢¿ÉÄÜÓ°ÏìÁËÈ«ÇòÊý°ÙÍòÓû§¡£¡£¡£¡£¡£¡£¡£

 

Ó°Ïì¹æÄ£

12.1<= Avast ºÍ AVG°æ±¾< 22.1

 

0x02 ´¦Öóͷ£½¨Òé

ÕâЩÎó²îÒÑÔÚ2022 Äê2 Ô 8 ÈÕÐû²¼µÄÈí¼þ°æ±¾ 22.1 ÖÐÐÞ¸´£¬£¬£¬£¬£¬£¬´ó´ó¶¼AvastºÍAVGÓû§½«×Ô¶¯×°ÖøüУ¬£¬£¬£¬£¬£¬½¨ÒéδÐÞ¸´µÄÓû§¾¡¿ì¸üС£¡£¡£¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://forum.avast.com/index.php?topic=317641.0

 

0x03 ²Î¿¼Á´½Ó

https://www.sentinelone.com/labs/vulnerabilities-in-avast-and-avg-put-millions-at-risk/

https://thehackernews.com/2022/05/researchers-disclose-10-year-old.html

https://securityaffairs.co/wordpress/130944/security/avast-avg-antivirus-flaws.html

 

0x04 ¸üа汾

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2022-05-06

Ê×´ÎÐû²¼

 

0x05 ¸½Â¼

¿­·¢k8¼ò½é

¿­·¢k8¹«Ë¾½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬£¬²¢ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉî½»ËùÖÐС°åÕýʽ¹ÒÅÆÉÏÊУ¬£¬£¬£¬£¬£¬ÊǺ£ÄÚ¼«¾ßʵÁ¦µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÍøÂçÇå¾²²úÆ·¡¢¿ÉÐÅÇå¾²ÖÎÀíÆ½Ì¨¡¢Ç徲ЧÀÍÓë½â¾ö¼Æ»®µÄ×ÛºÏÌṩÉÌ¡£¡£¡£¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°£¬£¬£¬£¬£¬£¬ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÓзÖÖ§»ú¹¹£¬£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÇþµÀϵͳºÍÊÖÒÕÖ§³ÖÖÐÐÄ£¬£¬£¬£¬£¬£¬²¢ÔÚ±±¾©¡¢ÉϺ£¡¢³É¶¼¡¢¹ãÖÝ¡¢³¤É³¡¢º¼ÖÝµÈ¶àµØÉèÓÐÑз¢ÖÐÐÄ¡£¡£¡£¡£¡£¡£¡£

¶àÄêÀ´£¬£¬£¬£¬£¬£¬¿­·¢k8ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£¡£

 

¹ØÓÚ¿­·¢k8

¿­·¢k8Çå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£¡£¡£¡£

¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png