CVE-2017-8308: avast antivirus Improper Privilege Management

Vulnerability summary

CVE-2017-8308 is a high (CVSS 7.5) Improper Privilege Management vulnerability in avast antivirus. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-04-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast product. This bypasses the Self-Defense feature of the product, opening a door to subsequent attack on many of its components.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.