Comodo Antivirus is affected by several vulnerabilities

Experts discovered several flaws in Comodo Antivirus, including a vulnerability that could allow to escape the sandbox and escalate privileges.

The Tenable expert David Wells discovered five flaws in the Comodo Antivirus and Comodo Antivirus Advanced.

Four of the vulnerabilities affect were version 12.0.0.6810 and one the version 11.0.0.6582.

The most severe flaw, tracked as CVE=2019-3969, could be exploited by an attacker with access to the target system to escape the Comodo Antivirus sandbox and escalate privileges to SYSTEM.

“An attacker can bypass this signing check however by changing the client’s process name within it’s PEB (Process Environment Block), or process hollowing a Comodo/Microsoft signed processes with malicious code. This is because CmdAgent’s signature check uses the filename from EnumProcessModules / GetModuleFilename for the COM Client’s PID. Once passing trusted binary check, an attacker can obtain an Instance of IServiceProvider.” reads the post published by Tenable. “With IServiceProvider, the attacker can then query for an interface to SvcRegKey and perform registry writes through the Out-Of-Proc COM server as “NT AUTHORTIY\SYSTEM”, allowing local privilege escalation.”

Another vulnerability, tracked as, CVE-2019-3970, is an arbitrary file write issue that could be’ exploited by an attacker to modify malware definitions and evade detection.

The remaining issue could be exploited by an attacker with access to the target system to trigger a DoS condition in the kernel and other components. All the flaws were rated As “medium” or “low” severity.

Wells published technical details for the sandbox escape/privilege escalation vulnerability in a post published on Medium.

Wells also published a Proof-of-concept exploit code on GitHub and a video PoC for the flaw.

Tenable reported the flaws to Comodo in April, but at the time of writing the vendor has yet to address them.

Pierluigi Paganini