Attacker Value
High
(2 users assessed)
Exploitability
High
(2 users assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
1

CVE-2019-3969: Comodo Antivirus Privilege Escalation

Disclosure Date: July 17, 2019 Last updated February 13, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent’s handling of COM clients. A local process can bypass the signature check enforced by CmdAgent via process hollowing which can then allow the process to invoke sensitive COM methods in CmdAgent such as writing to the registry with SYSTEM privileges.

Add Assessment

0
Ratings
  • Attacker Value
    Medium
  • Exploitability
    High
Technical Analysis

This is a very well-written research paper, with lots of artifacts and a Github-hosted PoC. As privesc’s go, this looks pretty reliable. Since I’m not seeing any publications from Comodo yet, this may still be useful in the wild.

General Information

Additional Info

Technical Analysis