14 antivirus apps found to have security problems

[Qtx]

COSEINC is a Singapore security outfit that has run a critical eye about 17 major antivirus engines and products and found dangerous local and remotely-exploitable vulnerabilities in 14.

Koret's analysis also suggests that antivirus companies fail by requiring overly extensive privileges, not signing product updates and delivering those over insecure HTTP, running excessive old code and not conducting proper source code reviews and fuzzing.

http://www.theregister.co.uk/2014/07..._audit_or_die/

Most of the report is stating what should be obvious to security bods. Kudos for finding the RCE's though. Expect AV patches soon.

[joglynne]

I was wondering which other antivirus apps were mentioned as having problems and found the following pdf of Koret's presentation if anyone else is interested.

http://www.syscan360.org/slides/2014...oxeanKoret.pdf

It includes this list ...

AV engines vulnerabilities

• Avast: Heap overflow in RPM (reported, fixed and paid Bug Bounty)
  
• Avg: Heap overflow with Cpio (fixed...)/Multiple vulnerabilities with packers
  
• Avira: Multiple remote vulnerabilities
  
• BitDefender: Multiple remote vulnerabilities
  
• ClamAV:Infinite loop with a malformed PE (reported & fixed)
  
• Comodo: Heap overflow with Chm
  
• DrWeb: Multiple remote vulnerabilities (vulnerability with updating engine fixed)
  
• ESET: Integer overflow with PDF (fixed)/Multiple vulnerabilities with packers
  
• F-Prot: Heap overflows with multiple packers
  
• F-Secure: Multiple vulnerabilities in Aqua engine (all the F-Secure own bugs fixed)
  
• Panda: Multiple local privilege escalations (reported and partially fixed)
  
• eScan: Multiple remote command injection (all fixed? LOL, I doubt...)

And many more...

[Pbryanw]

Interesting report - I see that Kaspersky also came under fire in the "2 random AVs nobody uses..." section. Norton seems unaccounted for too (I alternate between this and Kaspersky), but the report seems to suggest that the way Antivirus programs work make them all vulnerable to problems.

I still think the advantages of running a security suite outweigh the negatives, but it's good that research like this is being done, fed back to the companies, and problems found and fixed.