Researchers are warning of multiple unpatched vulnerabilities in Comodo’s antivirus software.
Tenable discovered five different vulnerabilities in Comodo Antivirus / Comodo Antivirus Advanced. The company also verified four of the unpatched bugs in version 12.0.0.6810 of Comodo Antivirus. A fifth bug CVE-2019-3973 only affects versions up to 11.0.0.6582.
The Tenable security team disclosed the flaws to Comodo back on April 17 of this year. Although Comodo did confirm some of the vulnerabilities, nearly three months have passed without any patches made available.
The five vulnerabilities included in the Tenable security advisory include:
- CVE-2019-3969: Local Privilege Escalation (CmdAgent.exe)
- CVE-2019-3970: Arbitrary File Write (Modification of AV Signatures)
- CVE-2019-3971: Denial of Service (CmdVirth.exe)
- CVE-2019-3972: Out-of-bounds Read (CmdAgent.exe)
- CVE-2019-3973: Out-of-Bounds Write (Cmdguard.sys).
“At the time of this disclosure, we are not aware of any patches released by Comodo that address these vulnerabilities,” Tenable added.
Finally, four of the vulnerabilities are rated Medium and have a CVSS score range between 4.6 and 6.8. Another one of the bugs is rated Low severity.
Readers can also check out more details regarding proof of concept on Github.