CVE-2019-17093 : Security Advisory and Response
Learn about CVE-2019-17093, a DLL Preloading vulnerability in Avast and AVG antivirus software versions prior to 19.8. Understand the impact, affected systems, exploitation, and mitigation steps.
A vulnerability has been identified in Avast antivirus versions prior to 19.8 and AVG antivirus versions prior to 19.8. This vulnerability involves DLL Preloading, where an attacker can insert %WINDIR%\system32\wbemcomn.dll, which is then executed within a protected-light process (PPL) and may bypass certain self-defense mechanisms. This vulnerability impacts all components that utilize WMI, such as AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0.
Understanding CVE-2019-17093
This CVE-2019-17093 vulnerability affects Avast and AVG antivirus software versions prior to 19.8.
What is CVE-2019-17093?
CVE-2019-17093 is a DLL Preloading vulnerability that allows an attacker to implant a malicious DLL, wbemcomn.dll, into a protected-light process, potentially bypassing self-defense mechanisms.
The Impact of CVE-2019-17093
The vulnerability can be exploited by attackers to execute arbitrary code within the context of the affected application, leading to potential system compromise and unauthorized access.
Technical Details of CVE-2019-17093
This section provides more technical insights into the vulnerability.
Vulnerability Description
The vulnerability arises from improper DLL loading in Avast and AVG antivirus software, enabling malicious DLL execution within a protected-light process.
Affected Systems and Versions
- Avast antivirus versions prior to 19.8
- AVG antivirus versions prior to 19.8
Exploitation Mechanism
- Attacker inserts %WINDIR%\system32\wbemcomn.dll
- DLL is executed within a protected-light process (PPL)
- Potential bypass of self-defense mechanisms
Mitigation and Prevention
Protect your systems from CVE-2019-17093 with the following steps:
Immediate Steps to Take
- Update Avast and AVG antivirus software to versions 19.8 or newer
- Monitor for any suspicious activities on the network
Long-Term Security Practices
- Implement application whitelisting to prevent unauthorized DLL execution
- Regularly update antivirus software and security patches
Patching and Updates
- Apply security patches provided by Avast and AVG promptly to mitigate the vulnerability