Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Monday March 16 2020, @04:22AM   Printer-friendly
from the bad-arrrrrguments dept.

Avast pulls plug on insecure JavaScript engine in its security software suite:

Avast has disabled a component in its Windows anti-malware suite that posed, ironically enough, a significant security risk.

The software maker switched off the JavaScript interpreter in its toolkit after Google Project Zero's Tavis Ormandy, and his colleagues, alerted the developer to design flaws in the code.

According to Avast, Ormandy potentially found a remote-code execution vulnerability in the software, the details of which were not publicly shared. Five days later, the Googler released a shell for poking around in Avast's JavaScript engine for anyone interested in assessing the antivirus suite. He also revealed that if miscreants were able to exploit any holes in Avast's JS engine on a victim's computer, they would be able to run malware on that PC with system-admin-level privileges.

[...]"Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage," Ormandy explained earlier this week. It should be noted Ormandy did not disclose any specific bugs.

A couple days after the analysis tool was released, the vendor opted to do away with the emulator entirely. It does not believe the removal will significantly impact the suite's ability to detect malware. The swift action was applauded by Ormandy.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Informative) by Joe Desertrat on Monday March 16 2020, @09:36PM

    by Joe Desertrat (2454) on Monday March 16 2020, @09:36PM (#972018)

    Anti-virus has been malware for a long time.

    If they had stuck to what they were originally supposed to be, virus detection and removal programs, maybe this would never have become the case. But it seems all of them want to be "security suites", which apparently means they try to do everything, do well at nothing as a result, and start prying into things they have no need to access.

    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3