Hot Take Norton, Avira, Avast, AVG affected by a Privilege Escalation Bug

[Viking]

Several popular Windows antivirus software brands under the Gen Digital umbrella were susceptible to a privilege escalation vulnerability.

The bug affected products from NortonLifelock (GenDigital), such as Norton Antivirus Windows Eraser Engine, Avira Security, Avast Antivirus, and AVG Antivirus. The vulnerability, tracked as CVE-2022-4294, was assigned a score of 7.1, indicating high severity.

According to an advisory published by Norton, four antivirus brands for Windows systems may be affected by a privilege escalation flaw. These types of vulnerabilities allow attackers to gain elevated system access after they initially compromise affected software.Privilege escalation flaws are valuable to attackers since they’re often required for various malicious activities but can get overlooked by developers because of their typically low severity scores.

According to Norton, the bug was fixed with “Avast and AVG Antivirus version 22.10, Norton Antivirus ERASER Engine 119.1.5.1 and Avira Security version 1.1.78.” “We encourage customers to ensure their security software are always updated to the latest version available,” the software provider said. The information in the advisory indicates the flaw was mitigated with updates released starting October 5 for Norton, October 20 for Avast and AVG, and November 22 for Avira.

Researcher Bahaa Naamneh, a technical fellow at cybersecurity firm Crosspoint Labs, was acknowledged by the company in the advisory on mitigating the vulnerability.

Norton, Avira, Avast, and AVG are owned by a multinational software company Gen Digital, formerly known as NortonLifeLick and Symantec Corporation. The company boasts a revenue of over $2.7 billion and employs over 2,700 people.

https://cybernews.com/news/norton-avira-avast-avg-privilege-escalation-bug/

 

[CyberDevil]

Very interesting. It seems that Norton has integrated its products with each other in some way, which means that some parts of the code are now common to all of its products. I wonder what this integration is. I would not be surprised if it is some kind of telemetry.

 

[piquiteco]

The bad thing is that if you unify all AVs into one product, is that if you discover a bug or a vulnerability in Avira for example, the others like Norton, Avast, AVG will be affected.

 

[Trident]

I wonder what this integration is.

Whilst I am unable to tell you what all integrations are as I don’t work there, the Enhanced Remediation and Side Effects Repair engine is what Norton and Symantec use to remove malware. The engine will use the graph (behavioural blocking information) to perform AGR (automated group remediation). Simply said, it will detect all the junk malware has created (files, folders, registry keys, scheduled tasks) and will shred them for good. Wherever graph holds no information it will use information from SCRIBE report (online emulation) to determine what needs to be removed as part of the attack.

ERASER is also capable of repairing damaged Windows files.