Description

Kaspersky Lab has fixed a vulnerability found in Kaspersky Embedded Systems Security by Embedi company. One of the KESS driver’s subroutine was vulnerable to buffer overflow that might allow an attacker to escalate permissions on a system.

List of affected products

• Kaspersky Embedded Systems Security 1.2.0.300
• Kaspersky Embedded Systems Security 2.0.0.385

Fixed Versions

Kaspersky Lab recommends that all customers using Kaspersky Embedded Systems Security 1.1 MR1 and 2.0 should install patch A.

Acknowledgments

We would like to extend our thanks to Embedi for reporting these bugs to Kaspersky Lab.

Description

Kaspersky Lab has fixed the vulnerabilities found in Kaspersky Internet Security for Android by the MRG Effitas company:

• CVE-2017-12816: Some of application exports activities have weak permissions, which might be used by malware application to get unauthorized access to the product functionality using Android IPC.
• CVE-2017-12817: Some of application trace files were not encrypted.

List of affected products

Kaspersky Internet Security for Android 11.12.4.1622.

Fixed Versions

Kaspersky Lab recommends that all customers using Kaspersky Internet Security for Android should upgrade to the new version 11.14.4.921 or higher.

Acknowledgments

We would like to extend our thanks to MRG Effitas for reporting these bugs to Kaspersky Lab.

Description

Kaspersky Lab has fixed vulnerabilities (CVE-2017-9810, CVE-2017-9811, CVE-2017-9812, CVE-2017-9813) found in the Web Console for Kaspersky Anti-Virus for Linux File Server 8, which allowed, under specific conditions, unauthorized access to some product functionality. To use these vulnerabilities, an attacker required to get in advance insights on structure of the network targeted and the user logged-in to Web Console to open the specific link from the phishing email on the targeted computer.

List of affected products

Kaspersky Anti-Virus for Linux File Server 8. Web Console is an opt-in feature, product is not vulnerable unless this feature is on.

Fixed Versions

Kaspersky Lab recommends that all customers using the Web Console, should upgrade Kaspersky Anti-Virus for Linux File Server 8 to the new CF4 version.

Acknowledgments

We would like to extend our thanks to Core Security and CoreLabs for reporting these bugs to Kaspersky Lab.

Description

Kaspersky Lab has fixed the vulnerabilities found in Kaspersky Embedded Systems Security by the Positive Technologies company:

• The Applications Launch Control component was unable to manage properly a large number of applications launching simultaneously. As a result, some applications were allowed to launch, even if these applications were to be strictly denied by the rules.
• The versions fixed provide the improved algorithm for the processing of a big quantity of applications launches and guarantee strict denial for a PowerShell script execution through placing the script body into the command line.
• No access restrictions on connection to the Kaspersky Embedded Systems Security filter driver were applied for other applications.

List of affected products

• Kaspersky Embedded Systems Security 1.1.
• Kaspersky Embedded Systems Security 1.1 MR1.

Fixed Versions

The vulnerability was fixed in Critical Fix KB13520.

To eliminate the vulnerability from Kaspersky Embedded Systems Security 1.1 upgrade the Kaspersky Embedded Systems Security to version 1.1 MR1 and apply Critical Fix KB13520: for x86, x64.

To eliminate the vulnerability from Kaspersky Embedded Systems Security 1.1 MR 1 apply Critical Fix KB13520: for x86, x64.

Acknowledgments

Description

Kaspersky Lab has fixed a vulnerability found by Cybellum Technologies which made a DLL Hijacking attack possible, via an undocumented feature of Microsoft Application Verifier. This allows the attacker to inject code into most OS processes, not just security solutions. It should be mentioned that this attack can only be performed thorough a local vector, when the attacker has already penetrated the device. The attacker has to infect the attacked computer with malicious software in advance, and escalate its privilege on the device in order to register a new Application Verifier Provider DLL – both actions require an attacker to use a range of other tools.

Fixed Versions

The detection and blocking of this malicious scenario has been added to all Kaspersky Lab products from 22 March. In order to stay protected, Kaspersky Lab recommends all customers keep their security solutions up to date and do not disable behavior-based detection features.

Kaspersky Lab will also incorporate additional protection measures into the next updates to its flagship security products. These will block the attack attempts described at different levels. The security solutions to be updated accordingly are:

• Kaspersky Anti-Virus 2018
• Kaspersky Internet Security 2018
• Kaspersky Total Security 2018
• Kaspersky Small Office Security 2018

Acknowledgments

Description

Kaspersky Lab has fixed a number of vulnerabilities found by Mr. Tavis Ormandy:

• Specific scenarios existed when unprivileged user might read file with a private key created by product for managing SSL connection. This could be used by attacker/malware with access to a host in order to obtain this file to perform targeted attacks on SSL connections initiated by browser application on the host.
  
• If user navigated to a web site with invalid SSL certificate and decided to trust it by selecting Continue on the product's warning in order to access the site, product added the certificate to trusted root incorrectly. That might be used by attacker to skip invalid certificate warning if user access sites that were listed in Subject Alternative Names of the original invalid SSL certificate.
  
• SSL certificate caching error existed that might be used by attacker with a control of network in order to perform targeted attack on a host to intercept SSL connections initiated by browser application specifically by using IP address instead of a domain name.
  

List of affected products

Kaspersky Anti-Virus 2016, 2017

Kaspersky Internet Security 2016, 2017

Kaspersky Total Security 2016, 2017

Kaspersky Small Office Security 4, 5

Kaspersky Fraud Prevention for Endpoints 6.0

Kaspersky Safe Kids for Windows 1.1

Kaspersky Endpoint Security for Mac

Fixed Versions

Kaspersky Anti-Virus 2016, 2017

Kaspersky Internet Security 2016, 2017

Kaspersky Total Security 2016, 2017

Kaspersky Small Office Security 4, 5

Kaspersky Fraud Prevention for Endpoints 6.0

Kaspersky Endpoint Security for Mac

The fixes are included in the autoupdated patches that were released by December, 28. To apply the fixes, please update your products.

Fix for Kaspersky Endpoint Security for Mac 10 included into new version SP1. To apply the fixes, please update to new product version.

Acknowledgments

Description

Kaspersky Lab has updated kaspersky.com website to mitigate potential XSS vulnerability.

Acknowledgments

Description

Kaspersky Lab has fixed a bug TALOS-CAN-0175 (CVE-2016-4329) reported by Cisco Talos in Kaspersky Anti-Virus products. This bug could have been exploited only if host already contained malicious program that might send certain unhandled window messages that might cause termination of GUI process of AV. GUI process restarts automatically after termination. This bug has no impact on AV functionality since it's being handled in separate service process. 

List of affected products

Kaspersky Internet Security 2016 (16.0.0.614) 

Kaspersky Anti-Virus 2016 (16.0.0.614) 

Kaspersky Total Security 2016 (16.0.0.614)

Fixed Versions

Kaspersky Internet Security 2017 (17.0.0.611) 

Kaspersky Anti-Virus 2017 (17.0.0.611) 

Kaspersky Total Security 2017 (17.0.0.611) 

User should migrate to newer version of respective products via product update procedure.

Acknowledgments

Description

Kaspersky Lab has fixed a number of vulnerabilities found by Cisco TALOS. All these vulnerabilities could have been exploited only if machine already contained malicious program 

- TALOS-CAN-0166 (CVE-2016-4304) and TALOS-CAN-0167 (CVE-2016-4305): a specially crafted call can cause an access violation in one of products drivers resulting in local denial of service. 

CVSSv3 score of this vulnerability is 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
- TALOS-CAN-0168 (CVE-2016-4306): a specially crafted call can cause the one of the products driver to return out of bounds kernel memory, potentially leaking sensitive information. 
CVSSv3 score of this vulnerability is 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

List of affected products

Kaspersky Internet Security 2016 (16.0.0.614) 

Kaspersky Anti-Virus 2016 (16.0.0.614) 

Kaspersky Total Security 2016 (16.0.0.614)

Fixed Versions

Kaspersky Internet Security 2017 (17.0.0.611) 

Kaspersky Anti-Virus 2017 (17.0.0.611) 

Kaspersky Total Security 2017 (17.0.0.611) 

User should migrate to newer version of respective products via product update procedure.

Acknowledgments

Description

Kaspersky Lab has fixed vulnerability TALOS-CAN-0169 (CVE-2016-4307) in Kaspersky Anti-Virus products. This vulnerability could have been exploited only if machine already contained malicious program that might used a bug in one of the products drivers to cause an access violation in it that results in local system denial of service. 

CVSSv3 score of this vulnerability is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

List of affected products

Kaspersky Internet Security 2016 (16.0.0.614) 

Kaspersky Anti-Virus 2016 (16.0.0.614) 

Kaspersky Total Security 2016 (16.0.0.614)

Fixed Versions

Acknowledgments

Description

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Mitigations

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

List of affected products

Fixed Versions

Acknowledgments

Description

Kaspersky Lab has fixed a number of bugs that were leading to the memory corruption, while parsing malformed files of the following formats: DEX, VB6, CHM, ExeCryptor, PE, "Yoda's Protector", and some other modified malicious files. The code in Kaspersky Lab’s Antivirus products had not been correctly handling malformed data that could cause integer and buffer overflows. 

List of products where this vulnerability has been found

Kaspersky Internet Security 2015 

Kaspersky Anti-Virus 2015
Kaspersky Endpoint Security 10 SP1MR1
Kaspersky Total Security 2015
Kaspersky Security for Virtualization 3.0 

Issue date for a fix or patch

The fix is included in the autoupdated modules that were released on 13 September 2015. 

Acknowledgments

We would like to thank Mr. Tavis Ormandy for his research. Kaspersky Lab has always supported the assessment of our solutions by independent experts. Their efforts help us to make our solutions stronger, more productive and more reliable.