AVG Internet Security 2015.5736 Address Space Layout Disclosure

medium Nessus Plugin ID 88933

Language:

Synopsis

An antivirus application installed on the remote Windows host is affected by an information disclosure vulnerability.

Description

The AVG Internet Security application installed on the remote Windows host is a version between 2015.5315 through 2015.5751, inclusive, with a virus definition database prior to version 9364. It is, therefore, affected by an information disclosure vulnerability due to insecure allocation of memory pages with Read, Write, and Execute (RWX) permissions at constant predictable addresses when protecting user-mode processes. An unauthenticated, remote attacker can exploit this to bypass the DEP and ASLR protection mechanisms, resulting in the disclosure of the address space layout.

Solution

Upgrade to the latest version of AVG Internet Security.

Plugin Details

Severity: Medium

ID: 88933

File Name: avg_internet_security_2015_5736.nasl

Version: 1.7

Type: local

Family: CGI abuses

Published: 2/24/2016

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: cpe:/a:avg:internet_security

Required KB Items: installed_sw/AVG Internet Security

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/12/2015

Vulnerability Publication Date: 12/8/2015

Reference Information

CVE: CVE-2015-8578

BID: 78813

Detections

Analytics