Kaspersky Lab recently patched four vulnerabilities in Kaspersky Internet Security Suite, which allowed attackers to overwhelm the antivirus and reveal information from the computer's memory.
The Cisco Talos team identified these four issues (CVE20164304, CVE20164305, CVE 20164306, and CVE20164307) that affect the product's KLIF, KLDISK, and KL1 drivers, which are used to interact with the underlying Windows API. One bug is an information disclosure vulnerability, and the other three are DoS (Denial of Service) issues that crash the application. DoS errors are considered annoying at best and are security in most software applications, but that is not the case for antivirus engines. The Cisco Talos team notes: “Although these vulnerabilities are not particularly severe, administrators should be aware that security systems can be used by threat actors as part of an attack, and keep such systems fully patched.”
An attacker who can execute code on a machine with Kaspersky antivirus installed could feed the antivirus with malicious code that could “crush” the security product, which would allow them to run more malicious code without the antivirus blocking their actions. Kaspersky has addressed all of the issues with updates to its Internet Security Suite. Earlier this month, at the Black Hat USA 2016 security conference in Las Vegas, Kaspersky announced that it had started a bug bounty program that will reward security researchers for finding and fixing security flaws in its software.
Kaspersky's decision was overshadowed by a similar announcement from Apple, as Cupertino also announced a bug bounty program.
