Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-6417: Avira Security Suites Allow Hackers to Take Control of Software

CVE-2017-6417 · published 9 years ago

Summary

Avira's Total, Optimization, Internet, and Free security suites have a weakness that lets an attacker on the same computer take full control of the software. This could happen if an attacker tricks the software into loading malicious code. Avira is working on a fix, and users should keep their software up to date to stay protected.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
avira	free_security_suite	<= 15.0 `cpe:2.3:a:avira:free_security_suite::::::::`
avira	internet_security_suite	<= 15.0 `cpe:2.3:a:avira:internet_security_suite::::::::`
avira	optimization_suite	<= 15.0 `cpe:2.3:a:avira:optimization_suite::::::::`
avira	total_security_suite	<= 15.0 `cpe:2.3:a:avira:total_security_suite::::::::`

Original advisory text

Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier), Optimization Suite 15.0 (and earlier), Internet Security Suite 15.0 (and earlier), and Free Security Suite 15.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avira process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

References

http://cybellum.com/doubleagent-taking-full-control-antivirus/ Third Party Advisory
http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique... Technical Description Third Party Advisory
http://www.securityfocus.com/bid/97021 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.7 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-427Uncontrolled Search Path Element

Timeline

Published21 Mar 2017

Updated3 Nov 2026

First seen15 Mar 2026

Sources

CVE-2017-6417 · OSV

CVE-2017-6417 · NVD

Track software like this

Free during beta