Improper input validation in Avast Antivirus Home
CVE-2009-3523
aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.008 (54.0th percentile) — read the EPSS interpretation.
Affected products
- Avast Avast_antivirus_home — versions 4.7.827, 4.7.844, 4.7.869
- Avast Avast_antivirus_professional — versions 4.7.827, 4.7.844, 4.7.1043
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (signature, x_refsource_OVAL, vdb-entry)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2009-3523?
- CVE-2009-3523 is a vulnerability in Avast Antivirus Home, classified under Improper Input Validation. Published 2009-10-01.
- Is CVE-2009-3523 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.