TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

245 pointsby landavealmost 8 years ago

13 comments

jacquesmalmost 8 years ago
Avast Antivirus, now with free remote reset option.<p>I always hated anti virus packages both for the fact that AV vendors profit on something that shouldn&#x27;t be required in the first place and because that software tends to hook into lots of places in the OS so <i>if</i> a backdoor is found you are immediately in big trouble.
评论 #14652693 未加载
_Codemonkeyismalmost 8 years ago
No one gets fired for installing Antivirus on every computer. From my experience enterprise IT is driven by checklist, looks good on paper, cover-my-* decisions. People are not interested in doing the right thing in large companies.<p>In one company every developer was forced on Antivirus without file exceptions making compilations a huge pain.
评论 #14652198 未加载
bazzarghalmost 8 years ago
Adobe deserve a pile of the blame here for the pdf spec - it only requires the magic to appear in the first 1024 bytes[1] (and that %EOF appears in the last 1024) - thus allowing silly tricks like PDFs that are also another file type [2].<p>[1] <a href="http:&#x2F;&#x2F;www.adobe.com&#x2F;content&#x2F;dam&#x2F;Adobe&#x2F;en&#x2F;devnet&#x2F;acrobat&#x2F;pdfs&#x2F;pdf_reference_1-7.pdf" rel="nofollow">http:&#x2F;&#x2F;www.adobe.com&#x2F;content&#x2F;dam&#x2F;Adobe&#x2F;en&#x2F;devnet&#x2F;acrobat&#x2F;pdf...</a> section 3.4.1<p>[2] <a href="https:&#x2F;&#x2F;www.slideshare.net&#x2F;ange4771&#x2F;a-binary-chimera" rel="nofollow">https:&#x2F;&#x2F;www.slideshare.net&#x2F;ange4771&#x2F;a-binary-chimera</a>
评论 #14652959 未加载
baqalmost 8 years ago
this is the second AV fiasco in recent months. is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?
评论 #14649725 未加载
评论 #14651777 未加载
评论 #14650231 未加载
评论 #14652576 未加载
评论 #14651069 未加载
评论 #14652567 未加载
评论 #14651837 未加载
评论 #14650444 未加载
jerardopealmost 8 years ago
Wow. It seems as if this has been discovered by rigorous manual inspection of the code (as opposed to just fuzzing the binary to death).<p>Hats off!
评论 #14648031 未加载
skizmalmost 8 years ago
This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If that is the case are things like function and variable names conserved? This is probably super trivial, but reverse engineering &#x2F; pen testing isn&#x27;t my area.
评论 #14652345 未加载
评论 #14651403 未加载
landavealmost 8 years ago
I am very surprised by the strong interest in this kind of work, and I appreciate it a lot!<p>I would love to hear some feedback, in the hope that the following posts will be more enjoyable than this first one.
staticassertionalmost 8 years ago
Take a lesson - always write parsers in C and then execute them as root, and be sure to send as much malicious content to them as possible. Bonus points for hooking it up to the internet.
评论 #14649317 未加载
评论 #14651847 未加载
azinman2almost 8 years ago
I bet Avast is far from the only software that will get really confused with so many magic numbers in a row like this.
Pxtlalmost 8 years ago
You know the edict against rolling your own crypto? It needs to be expanded to rolling your own collections in c&#x2F;c++.
评论 #14651168 未加载
raggialmost 8 years ago
Is the scanning engine sandboxed in any way, or is the stack protector all there is between a scanner bug and a remote exploit?
评论 #14652272 未加载
TwoBitalmost 8 years ago
That&#x27;s what you get when you don&#x27;t use std::vector.
kronos29296almost 8 years ago
You sir are a genius. Hoping for more posts of a similar nature and bookmarking now.
评论 #14649012 未加载