List of Advisories

Kaspersky appreciates the ongoing efforts of the independent researchers that help us make our products and solutions more efficient and better protected. Below you can find a list of disclosed vulnerabilities and researchers that reported them to us.

Advisory issued on November 1, 2022

Advisory issued on August 5, 2022

Advisory issued on March 31, 2022

Advisory issued on November 22, 2021

Description

Kaspersky has fixed the following security problems in consumer products for Windows:

[1] The installer of Kaspersky VPN Secure Connection was vulnerable to arbitrary file deletion. It could allow an attacker to delete any file during the installation procedure.
[2] The installers of Kaspersky Anti-Virus products family were vulnerable to loading of a specially crafted XML file during the installation procedure.
[3] A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High (CVE-2021-35052).
[4] An attacker could disable the Safe Money component of the company’s AV products by abusing Windows symbolic links (CVE-2022-27533).

List of affected products

Kaspersky VPN Secure Connection prior to 21.3 [1]
Kaspersky Anti-Virus prior to 21.3 [2]
Kaspersky Internet Security prior to 21.3 [1, 2]
Kaspersky Total Security prior to 21.3 [1, 2]
Kaspersky Small Office Security prior to 21.3 [2]
Kaspersky Security Cloud prior to 21.3 [1, 2]
Kaspersky Password Manager prior to 9.0.2 Patch R [3]
All versions of Kaspersky AV products for home (Kaspersky Security Cloud, Kaspersky Internet Security, Kaspersky Total Security) are affected by the issue [4]

Fixed versions

Kaspersky VPN Secure Connection 21.3 [1]
Kaspersky Anti-Virus 21.3 [2]
Kaspersky Internet Security 21.3 [1, 2]
Kaspersky Total Security 21.3 [1, 2]
Kaspersky Small Office Security 21.3 [2]
Kaspersky Security Cloud 21.3 [1, 2]
Kaspersky Password Manager 9.0.2 Patch R [3]
All versions of Kaspersky AV products for home (Kaspersky Security Cloud, Kaspersky Internet Security, Kaspersky Total Security) with antivirus databases released in November 2021 and later [4]

We recommend our users to check the application version and install the latest updates. Our home products support automatic updating procedure to make the process of receiving updates easier.

Acknowledgements

We would like to thank the following researchers who discovered the issues and responsibly reported them:

Mohammed Shameem Shahnawaz who discovered issues 1, 2 and reported them to us.
Abdelhamid Naceri working with Trend Micro Zero Day Initiative who discovered issues 3, 4 and reported them to us.

Phishing advisory issued on November 1, 2021

Advisory issued on November 1, 2021

Description

Kaspersky has fixed the following security problem in solutions for Windows:

Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable (CVE-2021-35053).

List of affected applications

Kaspersky Anti-Virus prior to 21.3.10.391(g)
Kaspersky Internet Security prior to 21.3.10.391(g)
Kaspersky Total Security prior to 21.3.10.391(g)
Kaspersky Small Office Security prior to 21.3.10.391(g)
Kaspersky Security Cloud prior to 21.3.10.391(g)
Kaspersky Endpoint Security versions from 11.1 to 11.6 (inclusively)

Fixed versions

Kaspersky Anti-Virus 21.3.10.391(g)
Kaspersky Internet Security 21.3.10.391(g)
Kaspersky Total Security 21.3.10.391(g)
Kaspersky Small Office Security 21.3.10.391(g)
Kaspersky Security Cloud 21.3.10.391(g)
Kaspersky Endpoint Security 11.7

We recommend our users to check the application version and install the latest updates. Our applications for home support automatic updating procedure to make the process of receiving updates easier.

For Kaspersky Endpoint Security users who are unable to update the product, we can recommend following to mitigate this issue:

Use Mozilla certificate store instead of Windows certificate store (default value) for scanning secure connections in Mozilla Firefox. To do this, enable the usage of Mozilla certificate store in local interface of the application and add Kaspersky certificate in Mozilla certificate store. Please contact Kaspersky technical support for the instruction on how to centrally change application settings for all computers of the company.

Acknowledgements

We would like to thank researcher Abdelhamid Naceri working with Trend Micro Zero Day Initiative who discovered the issue and responsibly reported it.

Advisory issued on April 27, 2021

Advisory issued on March 31, 2021

Description

Kaspersky has fixed the following security problems:

Description	Issue type	Affected products	Fixed products
[1] An authenticated attacker could terminate service component in product thus leaving a user without antivirus protection. The exploitation of this issue was possible in a local attack scenario and required from an attacker with user privileges in the system to run a specially crafted application.	Bypass	Kaspersky Anti-Virus prior to 20 Patch L Kaspersky Internet Security prior to 20 Patch L Kaspersky Total Security prior to 20 Patch L Kaspersky Small Office Security prior to 20 Patch L Kaspersky Security Cloud prior to 20 Patch L	Kaspersky Anti-Virus 20 Patch L Kaspersky Internet Security 20 Patch L Kaspersky Total Security 20 Patch L Kaspersky Small Office Security 20 Patch L Kaspersky Security Cloud 20 Patch L
[2] An authenticated attacker could terminate UI process of the product. Other product functionality (security protection) was not affected.	DoS	Kaspersky Anti-Virus from 21.1 and prior to 21.2 Kaspersky Internet Security from 21.1 and prior to 21.2 Kaspersky Total Security from 21.1 and prior to 21.2 Kaspersky Small Office Security from 21.1 and prior to 21.2 Kaspersky Security Cloud from 21.1 and prior to 21.2	Kaspersky Anti-Virus 21.2 Kaspersky Internet Security 21.2 Kaspersky Total Security 2021 21.2 Kaspersky Small Office Security 21.2 Kaspersky Security Cloud 21.2
[3] An authenticated attacker could trigger arbitrary file deletion in the system. Before doing this, an attacker had to create a specific file system reparse point and convince the user to run "Delete All Service Data And Reports" or "Save report on your computer" features.	LPE	Kaspersky Anti-Virus prior to 21.3 Kaspersky Internet Security prior to 21.3 Kaspersky Total Security prior to 21.3 Kaspersky Small Office Security prior to 21.3 Kaspersky Security Cloud prior to 21.3	Kaspersky Anti-Virus 21.3 Kaspersky Internet Security 21.3 Kaspersky Total Security 2021 21.3 Kaspersky Small Office Security 21.3 Kaspersky Security Cloud 21.3
[4] An authenticated attacker could trigger arbitrary file deletion in the system. Before do this an attacker must create a specific file system reparse point and convince a user to run the Browser Configuration Wizard.	LPE	Kaspersky Anti-Virus prior to 21.3 Kaspersky Internet Security prior to 21.3 Kaspersky Total Security prior to 21.3 Kaspersky Small Office Security prior to 21.3 Kaspersky Security Cloud prior to 21.3	Kaspersky Anti-Virus 21.3 Kaspersky Internet Security 21.3 Kaspersky Total Security 21.3 Kaspersky Small Office Security 21.3 Kaspersky Security Cloud 21.3
[5] Due to improper client authorization on XPC service, KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection (CVE-2021-26718).	LPE	Kaspersky Internet Security for Mac prior to 21.1	Kaspersky Internet Security for Mac 21.1

We recommend our users to check the application version and install the latest updates. Our home products support automatic updating procedure to make the process of receiving updates easier. To apply these updates a computer reboot may be required. To update a solution for business, please contact our technical support to clarify the details.

Acknowledgements

We would like to thank the following researchers who discovered the issues and responsibly reported them:

Kim Dong-Hyeon (abbadeed) who discovered issues 1, 2 and reported them to us.
Abdelhamid Naceri (halove23) who discovered issues 3, 4 and reported them to us.
Csaba Fitzl (theevilbit) who discovered issue 5 and reported it to us.

Advisory issued on March 30, 2021

Description

Kaspersky has fixed the following security issues in consumer and corporate products for Windows that were publicly disclosed earlier.

[1] The web protection component was vulnerable to arbitrary file corruption due to insufficient check of file paths on reparse points. Using this flaw, an authenticated attacker could abuse our component to corrupt arbitrary files in the system without any interaction with the user. Issue type: LPE.
[2] The Safe Money component that provides secure online operations was vulnerable to arbitrary code execution with high privileges. To exploit this issue an authenticated attacker needed to interact with the user. Issue type: LPE.

List of affected products

Kaspersky Anti-Virus version 21.2 and earlier [1]
Kaspersky Internet Security version 21.2 and earlier [1, 2]
Kaspersky Total Security version 21.2 and earlier [1, 2]
Kaspersky Security Cloud version 21.2 and earlier [1, 2]
Kaspersky Small Office Security version 21.2 and earlier [1, 2]
Kaspersky Endpoint Security for Windows 11.5.0 and earlier [1]

Fixed versions

Kaspersky Anti-Virus version 21.3 [1]
Kaspersky Internet Security version 21.3 [1, 2]
Kaspersky Total Security version 21.3 [1, 2]
Kaspersky Security Cloud version 21.3 [1, 2]
Kaspersky Small Office Security version 21.3 [1, 2]
Kaspersky Endpoint Security for Windows version 11.6.0 [1]

We recommend our users to check the application version and install the latest updates. Our home products support automatic updating procedure to make the process of receiving updates easier. To apply these updates a computer reboot may be required. To update a solution for business, please contact our technical support to clarify the details.

Our anti-malware detection rules for the products were updated and delivered to users once we got information about the issues. This allowed us to block attempts of exploiting the vulnerability before the updates became available (PDM:Exploit.Win32.Generic.nblk).

Advisory issued on 17th February, 2021

Advisory issued on 15th December, 2020

Description

Kaspersky has fixed the following security problems in products for Windows:

Issue 1: Due to unsafe DLL search path, the installer of Kaspersky Anti-Ransomware Tool (KART) was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system. Issue type: LPE.
Issue 2: One of AV engine's components was vulnerable to a path traversal attack thus allowing an attacker to create files in privileged file locations. Issue type: LPE.
Issue 3: In minor scenarios, Kaspersky Password Manager could run a browser with High integrity level. Issue type: LPE.
Issue 4: Unused Data Cleaner component in Kaspersky Total Security has been improved against attacks based on the abuse of symbolic links. Issue type: LPE.
Issue 5: File Shredder component in Kaspersky Total Security that provides secure file deletion was vulnerable to a race condition attack when checking a file path for reparse points. Using this flaw, an attacker could use this component to delete arbitrary files in the system. Issue type: LPE.

List of affected products

Kaspersky Anti-Ransomware Tool prior to version 5.0 patch E (issue 1)
Kaspersky Password Manager prior to version 9.2 patch L (issue 3)
Kaspersky Total Security prior to version 2021 (issue 4)
Kaspersky Security Cloud prior to version 2021 (issue 4)
Kaspersky Total Security prior to version 2021 MR2 (issue 5)
Kaspersky Security Cloud prior to version 2021 MR2 (issue 5)

Fixed versions

Kaspersky Anti-Ransomware Tool 5.0 patch E (issue 1)
Kaspersky Password Manager 9.2 patch L (issue 3)
Kaspersky Total Security 2021 (issue 4)
Kaspersky Security Cloud 2021 (issue 4)
Kaspersky Total Security 2021 MR2 (issue 5)
Kaspersky Security Cloud 2021 MR2 (issue 5)

To fix the issue 2, update antivirus databases to the latest version or wait for the automatic update.

We recommend our users to check the application version and install the latest updates. Our home products support automatic updating procedure to make the process of receiving updates easier. To apply these updates a computer reboot may be required. To update a solution for business, please contact our technical support to clarify the details.

Acknowledgements

We would like to thank the following researchers who discovered the issues and responsibly reported them:

Eran Shimony of CyberArk Labs who discovered issue 1 and reported it to us.
houjingyi who discovered issue 2 and reported it to us.
Abdelhamid Naceri who discovered issues 3, 4, 5 and reported it to us.

Advisory issued on 29th July, 2020

Description

Kaspersky has fixed the following security problems in products for Windows:

The installer of Kaspersky VPN Secure Connection was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system (CVE-2020-25043). Issue type: DoS.
Kaspersky Virus Removal Tool (KVRT) was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to eliminate content of any file in the system (CVE-2020-25044). Issue type: DoS.
Due to unsafe DLL search path, the installer of Kaspersky Security Center was susceptible to a DLL hijacking attack that allowed an attacker to elevate privileges in the system (CVE-2020-25045). Issue type: LPE.
Due to unsafe DLL search path, the installer of Kaspersky Security Center Web Console was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system (CVE-2020-25045). Issue type: LPE.
Due to unsafe DLL search path, the installer of Kaspersky Anti-Ransomware Tool (KART) was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system (CVE-2020-28950). Issue type: LPE.

The above issues are classified as local attacks. It means that an attacker should be authenticated in the system at the time of attack. Cases 1, 3, 4, 5 can be exploited only during the installation of a product. We have not registered any attempts to exploit these vulnerabilities in the wild.

List of affected products

Kaspersky VPN Secure Connection prior to 5.0
Kaspersky Virus Removal Tool prior to 15.0.23.0
Kaspersky Security Center prior to 12
Kaspersky Security Center Web Console prior to 12 Patch A
Kaspersky Anti-Ransomware Tool prior to KART 4.0 Patch C

Fixed versions

Kaspersky VPN Secure Connection 5.0
Kaspersky Virus Removal Tool 15.0.23.0
Kaspersky Security Center 12
Kaspersky Security Center Web Console 12 Patch A
Kaspersky Anti-Ransomware Tool 4.0 Patch C

We recommend our users to check the application version and install the latest updates. To make the process of receiving updates easier, our home products support automatic updates. A computer reboot may be required for applying updates. To update a solution for business, please contact our technical support for details.

Acknowledgements

We would like to thank the following researchers who discovered the issues and responsibly reported them:

Eran Shimony of CyberArk Labs who discovered issues 1, 2, 3, and 4 and reported it to us.
Shahee Mirza of BEETLES who discovered issue 5 and reported it to us.

Advisory issued on 15th May, 2020

Description

Kaspersky has fixed a security issue in its consumer and corporate products that was publicly disclosed earlier. Fixed versions of the products were released several months ago. The vulnerability allowed abuse of products' AV scanning feature for arbitrary file deletion. The exploitation of this issue was possible in a local attack scenario and required from an attacker to be authenticated in the system to run a specially crafted application.

List of affected products

Consumer products for Windows:

Kaspersky Anti-Virus prior to 2019
Kaspersky Internet Security prior to 2019
Kaspersky Total Security prior to 2019
Kaspersky Free prior to 2019
Kaspersky Security Cloud prior to 2019

Corporate products for Windows:

Kaspersky Small Office Security prior to 6
Kaspersky Endpoint Security prior to 11.1

Consumer products for macOS:

Kaspersky Internet Security prior to 2020 Patch A

Corporate products for Linux:

Kaspersky Endpoint Security prior to version 10 SP1 MR1

Fixed versions

Consumer products for Windows:

Kaspersky Anti-Virus 2019 and later
Kaspersky Internet Security 2019 and later
Kaspersky Total Security 2019 and later
Kaspersky Free 2019 and later
Kaspersky Security Cloud 2019 and later

Corporate products for Windows:

Kaspersky Small Office Security 6 and later
Kaspersky Endpoint Security 11.1 and later

Consumer products for macOS:

Kaspersky Internet Security 2020 Patch A and later

Corporate products for Linux:

Kaspersky Endpoint Security 10 SP1 MR1 and later

We recommend our users to check the application version and install the latest updates. Our home products support automatic updating procedure to make the process of receiving updates easier. To apply these updates a computer reboot may be required. To update a solution for business, please contact our technical support to clarify the details.

Acknowledgements

We would like to thank company RACK911 Labs who discovered the issue and reported it to us.

Advisory issued on 26th February, 2020

Description

Kaspersky has fixed a security issue in consumer and corporate products that was publicly disclosed earlier. A component responsible for interprocess communications was vulnerable to arbitrary code execution due to weak check of incoming data in some specific cases. Depending on the product, this could allow an attacker to elevate privileges in the OS, provided that the vulnerable component works within the context of process with high privileges. At the moment of exploitation an attacker must be already authenticated in the system (local attack). In case of such products as consumer Kaspersky Anti-Virus products family and Endpoint Security, an attacker also needs to bypass product's self-defense to perform exploitation.

We have not registered any attempts to exploit this vulnerability in the wild.

List of affected products

Consumer products for Windows:

Kaspersky Anti-Virus prior to 2019 Patch H, 2020 Patch D.
Kaspersky Internet Security prior to 2019 Patch H, 2020 Patch D.
Kaspersky Total Security prior to 2019 Patch H, 2020 Patch D.
Kaspersky Free prior to 2019 Patch H, 2020 Patch D.
Kaspersky Security Cloud prior to 2019 Patch H, 2020 Patch D.
Kaspersky Password Manager prior to 9.2 Patch C.
Kaspersky Safe Kids prior to 1.5 Patch C.
Kaspersky Software Updater prior to 2.1 Patch A.

Corporate products for Windows:

Kaspersky Endpoint Security 10 SP2 without pf3223.
Kaspersky Endpoint Security 10 SP2 MR3 without pf3528.
Kaspersky Endpoint Security 11.0.0 without pf5145.
Kaspersky Endpoint Security 11.0.1 without pf5352.
Kaspersky Endpoint Security 11.1 without pf7063.
Kaspersky Endpoint Security 11.1.1 without pf7523.
Kaspersky Small Office Security prior to 6 Patch H, 7 Patch D.
Kaspersky Anti Targeted Attack Agent prior to 3.6.1.

Fixed versions

Consumer products for Windows:

Kaspersky Anti-Virus 2019 Patch H, 2020 Patch D and later.
Kaspersky Internet Security 2019 Patch H, 2020 Patch D and later.
Kaspersky Total Security 2019 Patch H, 2020 Patch D and later.
Kaspersky Free 2019 Patch H, 2020 Patch D and later.
Kaspersky Security Cloud 2019 Patch H, 2020 Patch D and later.
Kaspersky Password Manager 9.2 Patch C and later.
Kaspersky Safe Kids 1.5 Patch C and later.
Kaspersky Software Updater 2.1 Patch A and later.

Corporate products for Windows:

Kaspersky Endpoint Security 10 SP2 with pf3223.
Kaspersky Endpoint Security 10 SP2 MR3 with pf3528.
Kaspersky Endpoint Security 11.0.0 with pf5145.
Kaspersky Endpoint Security 11.0.1 with pf5352.
Kaspersky Endpoint Security 11.1 with pf7063.
Kaspersky Endpoint Security 11.1.1 with pf7523.
Kaspersky Small Office Security 6 Patch H, 7 Patch D and later.
Kaspersky Anti Targeted Attack Agent 3.6.1.

We recommend users to check product version and install updates. Our home products support automatic updating procedure to make process of receiving updates easier. To apply these updates a reboot may be required. To update a solution for business, please contact out technical support via Kaspersky CompanyAccount to receive a patch.

Our anti-malware detection rules for the products were updated and delivered to users once we got information about the issue. This allowed us to block attempts of exploiting the vulnerability before the updates became available (PDM:Exploit.Win32.Virsli.a).

Advisory issued on 2nd December, 2019

Description

Kaspersky has fixed a security issue CVE-2019-15689 found in Kaspersky Secure Connection 4.0 (2020). One of the product executable files was susceptible to a DLL hijacking attack that could potentially allow third-parties to locally execute arbitrary code in its process context. The severity of the issue was assessed as low, because an attacker must have administrator privileges to drop malicious DLL file into the product's folder. No privilege escalation. Issue category: DLL hijacking. Issue type: Arbitrary Code Execution.

We also have fixed three bugs in one of anti-virus (AV) engine components that is responsible for work with ZIP archives. The fix for this component corrects its behaviour in situation of antivirus scanning specially crafted ZIP archives. These malformed archives could be used to circumvent our antivirus scan process. The bugs affected Kaspersky products with antivirus databases.

List of affected products

The issue affected Secure Connection product and consumer products in those it is incorporated:

Kaspersky Secure Connection prior to version 4.0 (2020) patch E.
Kaspersky Internet Security prior to version 2020 patch E.
Kaspersky Total Security prior to version 2020 patch E.
Kaspersky Security Cloud prior to version 2020 patch E.

Fixed versions

Kaspersky Secure Connection 4.0 (2020) patch E.
Kaspersky Internet Security 2020 patch E.
Kaspersky Total Security 2020 patch E.
Kaspersky Security Cloud 2020 patch E.

We recommend users to install these updates. Our products have automatic updating procedure to make process of receiving updates easier. To apply these updates, the product restart is required. Also to eliminate mentioned bugs in antivirus engine it is necessary to update antivirus bases to the latest version, which is performed automatically during auto-updating procedure.

Acknowledgements

We would like to thank the following researchers who discovered the issues and responsibly reported them:

Peleg Hadar from SafeBreach for reporting DLL hijacking in Secure Connection.
Thierry Zoller for reporting bugs in antivirus engine.

Advisory issued on 25th November, 2019

Description

Kaspersky has fixed the following security problems in Anti-Virus products family for Windows:

[1] Kaspersky Protection extension for web browser Google Chrome was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions. Severity of this issue was assessed as medium, because user should confirm deletion of the extension on Chrome's warning menu. Issue category: Unauthorized Command Execution. Issue type: Bypass. [CVE-2019-15684]
[2] The web protection component due to a bug in its implementation potentially allowed an attacker remotely disable such product's security features as private browsing and anti-banner. Issue category: Unauthorized Command Execution. Issue type: Bypass. [CVE-2019-15685]
[3] The web protection component due to a bug in its implementation potentially allowed an attacker remotely disable various anti-virus protection features. Severity of this issue was assessed as high, because an attacker can terminate product service process. Issue category: Unauthorized Command Execution. Issue type: DoS, Bypass. [CVE-2019-15686]
[4] The web protection component was vulnerable to remote disclosure of some information about user's system to 3rd parties (e.g. Windows version and version of the product, unique ID). Issue category: Data Leakage. Issue type: Information Disclosure. [CVE-2019-15687]
[5] The web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Issue category: Security Bypass. Issue type: Bypass. [CVE-2019-15688]

The web protection component was additionally improved to prevent 3rd parties from calculating unique product ID remotely (privacy hardening) [6].

To exploit all mentioned above issues an attacker would need to lure a user for visiting a specially crafted web page.

List of affected products

Kaspersky Anti-Virus up to 2020
Kaspersky Internet Security up to 2020
Kaspersky Total Security up to 2020
Kaspersky Free Anti-Virus up to 2020
Kaspersky Small Office Security up to 7
Kaspersky Security Cloud up to 2020
Kaspersky Protection extension for Google Chrome prior to 30.112.62.0

Fixed versions

Kaspersky Anti-Virus 2019 Patch I, Patch J
Kaspersky Internet Security 2019 Patch I, Patch J
Kaspersky Total Security 2019 Patch I, Patch J
Kaspersky Free Anti-Virus 2019 Patch I, Patch J
Kaspersky Small Office Security 6 Patch I, Patch J
Kaspersky Security Cloud 2019 Patch I, Patch J
Kaspersky Protection extension for Google Chrome 20.0.543.1418 as a part of 2019 Patch I

Kaspersky Anti-Virus 2020, 2020 Patch E, 2020 Patch F
Kaspersky Internet Security 2020, 2020 Patch E, 2020 Patch F
Kaspersky Total Security 2020, 2020 Patch E, 2020 Patch F
Kaspersky Free Anti-Virus 2020, 2020 Patch E, 2020 Patch F
Kaspersky Small Office Security 7, 7 Patch E, 7 Patch F
Kaspersky Security Cloud 2020, 2020 Patch E, 2020 Patch F
Kaspersky Protection extension for Google Chrome 30.112.62.0 as a part of 2020 Patch E
Kaspersky Protection extension for Google Chrome 30.147.100.0 as a part of 2020 Patch F

We recommend users to check product version and install updates. Our products have automatic updating procedure to make process of receiving updates easier and most of the users have been updated. To apply these updates a reboot may be required.

Acknowledgements

We would like to thank the following researchers who discovered the issues and responsibly reported them:

Wladimir Palant ([1],[2],[3],[4],[5],[6])
Mohamed Ouad ([1])

Advisory issued on 16th August, 2019

Advisory issued on 11th July, 2019

Advisory issued on 8th July, 2019

Advisory issued on 8th May, 2019

Advisory issued on 24th December, 2018

Advisory issued on 19th July, 2018

Advisory issued on 12th April, 2018

Advisory issued on 1st February, 2018

Advisory issued on 27th October, 2017

Advisory issued on 9th October, 2017

Advisory issued on 9th August, 2017

Advisory issued on 28th June, 2017

Advisory issued on 15th May, 2017

Advisory issued on 22th March, 2017

Advisory issued on 28th December, 2016

Description

Kaspersky Lab has fixed a number of vulnerabilities found by Mr. Tavis Ormandy:

Specific scenarios existed when unprivileged user might read file with a private key created by product for managing SSL connection. This could be used by attacker/malware with access to a host in order to obtain this file to perform targeted attacks on SSL connections initiated by browser application on the host.
If user navigated to a web site with invalid SSL certificate and decided to trust it by selecting Continue on the product's warning in order to access the site, product added the certificate to trusted root incorrectly. That might be used by attacker to skip invalid certificate warning if user access sites that were listed in Subject Alternative Names of the original invalid SSL certificate.
SSL certificate caching error existed that might be used by attacker with a control of network in order to perform targeted attack on a host to intercept SSL connections initiated by browser application specifically by using IP address instead of a domain name.

List of affected products

Kaspersky Anti-Virus 2016, 2017

Kaspersky Internet Security 2016, 2017

Kaspersky Total Security 2016, 2017

Kaspersky Small Office Security 4, 5

Kaspersky Fraud Prevention for Endpoints 6.0

Kaspersky Safe Kids for Windows 1.1

Kaspersky Endpoint Security for Mac

Fixed Versions

Kaspersky Anti-Virus 2016, 2017

Kaspersky Internet Security 2016, 2017

Kaspersky Total Security 2016, 2017

Kaspersky Small Office Security 4, 5

Kaspersky Fraud Prevention for Endpoints 6.0

Kaspersky Endpoint Security for Mac

The fixes are included in the autoupdated patches that were released by December, 28. To apply the fixes, please update your products.

Fix for Kaspersky Endpoint Security for Mac 10 included into new version SP1. To apply the fixes, please update to new product version.

Acknowledgments

We would like to extend our thanks to Tavis Ormandy for reporting these bugs to Kaspersky Lab.

Advisory issued on 1st October, 2016

Advisory issued on 1st September, 2016

Advisory issued on 25th August, 2016

Advisory issued on 3rd August, 2016

Advisory issued on 28th July, 2016

Advisory issued on 10th March, 2016

Advisory issued on 3rd March, 2016

Advisory issued on 25th January, 2016

Advisory issued on 24th December, 2015

Advisory issued on 23rd December, 2015

Advisory issued on 16th November, 2015

Description

Kaspersky Lab has identified that the below mentioned products are susceptible to memory corruptions while scanning malformed files of RAR and ZIP formats. These vulnerabilities have maximum security impact of remote code execution and could corrupt memory this way: an attacker could execute arbitrary code in the context of the Antivirus process. In order to exploit the vulnerabilities an attacker has to convince user to upload a maliciously malformed ZIP or RAR file from external resources. This, for example, might be done by convincing a user to download a malicious file from a specially crafted website or by sending them a malicious file via e-mail. Memory corruptions can possibly occur while scanning this file. The fix addresses the vulnerabilities by modifying processing of malformed RAR and ZIP files.

CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

List of affected products

Kaspersky Anti-Virus for Lotus Domino: 8.2

Kaspersky Linux Mail Security: 8.0, 8.0.1

Kaspersky Security for Mail Gateway:1.0

Kaspersky Anti-Virus for Proxy Server: 5.5

Kaspersky Security for Virtualization Agentless: 1.1.0.79, 2.0.0.34, 2.0.0.69, 3.0.0.92, 3.1.0.77

Kaspersky Anti-Virus: 2013, 2014, 2015

Kaspersky Internet Security: 2013, 2014, 2015

Kaspersky PURE 3

Kaspersky Small Office Security 3

Kaspersky Endpoint Security for Windows: 10 , 10 MR1, 10 SP1

Kaspersky Endpoint Security for Windows: 8, 8 CF1, 8 CF2

Kaspersky Anti-Virus 6.0 R2 for Windows Workstations: 6 MP4 CF1 and CF2

Kaspersky Security for SharePoint Server: 8.0 mp1, 8.0 mp1cf1, 9.0, 9.0 mp1, 9.0

Kaspersky Security for Microsoft Exchange Server: 8.3, 8.6.79, 9.0.129, 9.1.42, 9.2.39

Kaspersky Anti-Virus for Lotus Domino: 8.2

Kaspersky Anti-Virus for Windows Servers EE: 8 TR, SP1, SP2, 10

Kaspersky Anti-Virus for Linux File Servers: 8.0.1.145, 8.0.2.256, 8.0.2.256, 8.0.3.265

Kaspersky Endpoint Security for Linux: 8.0.0.35, 8.1.0.50

Fixed Versions

The fix is included in the autoupdated modules that were released on 13 November, 2015 for all the products listed above.

Acknowledgments

We would like to extend our thanks to Tavis Ormandy for reporting these bugs to Kaspersky Lab.

Product Name	Vulnerable Version	Fixed Version
TDSSKiller	3.1.0.7	3.1.0.8
RectorDecryptor	2.6.36.0	2.7.0.0
RakhniDecryptor	1.14.13.2	1.14.13.3
RannohDecryptor	1.8.0.1	1.8.0.2
ScatterDecryptor	2.0.0.0	2.0.0.1
XoristDecryptor	2.3.46.0	2.4.0.0
CapperKiller	1.0.11.0	1.0.12.0
KidoKiller	3.4.14.0	3.4.15.0
FippKiller	1.0.2.0	1.0.3.0
SalityKiller	1.3.6.0	1.3.7.0
VirutKiller	1.0.11.0	1.0.12.0
XpajKiller	1.6.6.0	1.6.7.0
ZBotKiller	1.3.0.0	1.3.1.0
RadminerFlashRestorer	1.0.0.0	1.0.1.0
Kabasiji	12.0.0.20	12.0.0.21
Kabasigi	1.2.2.0	1.2.3.0
ScraperDecryptor	1.0.0.1	1.0.0.2
PMaxKiller	1.0.1.0	1.0.2.0
DigitaCure	1.3.0.1	1.3.0.2
CleanAutoRun	1.2.0.0	1.2.1.0
KVRT	15.0.19.0 patch d	15.0.19.0 patch e