CVE-2017-15643
HighSummary
An active network attacker (MiTM) can achieve remote code execution on a machine running IKARUS Anti Virus 2.16.7. The attacker exploits cleartext HTTP updates and CRC32 for file verification.
Risk Assessment
This vulnerability allows for remote introduction of malicious software, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update IKARUS Anti Virus to the latest version and implement security measures to prevent MiTM attacks.
Other vulnerabilities in IKARUS Anti Virus 2.16.7
See all- CVE-2017-17804High
In IKARUS anti.virus version 2.16.20, the driver file (ntguard.SYS) does not validate input values from IOCtl 0x83000084, allowing local users to cause a denial of service (BSOD) or possibly have unspecified other impact.
- CVE-2017-17797High
In IKARUS anti.virus version 2.16.20, the driver file (ntguard.SYS) does not validate input values from IOCtl 0x83000058, allowing local users to cause a denial of service (BSOD) or potentially unspecified other impacts.
- CVE-2017-17795High
In IKARUS anti.virus version 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact due to not validating input values from IOCtl 0x83000088.
- CVE-2017-14961High
The ntguard.sys driver in IKARUS anti.virus version 2.16.7 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x8300000c.
Original NVD description (English source)
An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response, so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update, with a Trojan horse executable file (e.g., guardxup.exe) and the correct CRC32 checksum for that file.