Avira Internet Security System Speedup Insecure Deserialization

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without implementing input validation or deserialization safeguards. Because the file can be created or modified by a local user in default configurations, an attacker can supply a crafted serialized payload that is deserialized by the privileged process, resulting in arbitrary code execution as SYSTEM.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

可信数据的反序列化

Avira Internet Security 安全漏洞

Avira Internet Security是德国Avira公司的一款网络安全防护软件。 Avira Internet Security存在安全漏洞，该漏洞源于System Speedup组件反序列化不可信数据，可能导致本地攻击者以SYSTEM权限执行任意代码。

N/A

N/A