Security flaw discovered in NOD32 Antivirus

[Zeus_Hunt]

NOD32, the antivirus solution that is meant to protect our computer, is quite buggy and might allow an attacker to take control over an affected system. According to the security company Secunia, a successful exploitation of the vulnerability can provide higher privileges to an attacker without giving any notification of the user. It seems that the flaw exists in the edition released before version 2.70.39 so, the only solution is to update your antivirus solution to the latest version.

"Ismael Briones has reported two vulnerabilities in Nod32 Antivirus, which potentially can be exploited by malicious users to gain escalated privileges, or by malicious people to compromise a vulnerable system. The vulnerabilities are caused due to boundary errors when cleaning, deleting, or renaming files detected as malware. These can be exploited to cause stack-based buffer overflows via a specially crafted directory containing malware with an overly long directory or path name. Successful exploitation may allow execution of arbitrary code," Secunia said in the security advisory.

The security company rated the flaw as moderately critical and sustained that it affects the antivirus solution installed on Windows NT, 2000, XP and 2003.

As you can see, we're no longer secure, even if we installed an antivirus solution able to protect our computers. In the past, most of the applications that were meant to defend the systems proved us that they're vulnerable and that an attacker can obtain administrator privileges through a successful attack. Using this security flaw, NOD32 joins Kaspersky Antivirus and Symantec's Norton Antivirus, two of the most popular antivirus products that were recently affected by similar problems. However, NOD32 is regarded by a lot of users as the most efficient antivirus tool because it manages to offer well-developed functions bundled with minimal requirements.

View: Original Article

[nsane]

Successful exploitation may allow execution of arbitrary code," Secunia said in the security advisory.

just for reference, when they use phrases like that, it means no one could actually get it to work. so they basically patched a possible sploit in NOD32 and not some 0day flaw being used by a worm or something :sui:

so don't go thinking "oh nos, im ganna be hax0red because my german build is old!" :eek:

[Bolt_Gundam510]

that figures they would come up with something like that. but each to there own i say.