Avast Free Antivirus Symbolic Link DoS Vulnerability (CVE-2024-7228)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: (0Day) Avast Free Antivirus Link Following Denial-of-Service Vulnerability 2. CVE ID: CVE-2024-7228 3. CVSS Score: 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) 4. Affected Vendor: Avast 5. Affected Product: Free Antivirus 6. Vulnerability Details: - Allows a local attacker to create a denial-of-service condition on an affected Avast Free Antivirus installation. - The attacker must first gain the ability to execute low-privilege code on the target system. - The vulnerability exists in the Avast Service; by creating symbolic links, an attacker can abuse the service to create a folder. - Attackers can exploit this vulnerability to create a denial-of-service condition on the system. 7. Additional Details: - December 11, 2023: ZDI reported the vulnerability to Avast’s Security Reports team. - February 24, 2024: ZDI inquired about updates. - March 15, 2024: ZDI notified the vendor that, due to no response, a 0-day announcement would be published on March 27, 2024. - April 25, 2024: A Gen Digital team member notified that all security issues should be submitted through the third-party vulnerability disclosure program. - May 22, 2024: ZDI resubmitted the vulnerability to the third-party vulnerability disclosure program. - June 19, 2024: ZDI inquired about updates. - July 26, 2024: ZDI notified the vendor that, due to no response, a 0-day announcement would be published on July 29, 2024. 8. Mitigation: Due to the nature of the vulnerability, the only mitigation strategy is to limit interaction with the application. 9. Disclosure Timeline: - December 11, 2023: Vulnerability reported to the vendor. - July 29, 2024: Coordinated public announcement published. - August 15, 2024: Announcement updated. 10. Credit: Nicholas Zubrisky (@NZubrisky) and Michael DePlante (@izobashi) from Trend Micro’s Zero Day Initiative. This information provides a detailed description of the vulnerability, its impact scope, discovery and disclosure process, and mitigation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Avast Free Antivirus Symbolic Link DoS Vulnerability (CVE-2024-7228)