Vulnerabilities > CVE-2010-5157 - Race Condition vulnerability in Comodo Internet Security

CVSS 6.2 - MEDIUM

Attack vector

LOCAL

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

high complexity

comodo

microsoft

CWE-362

NVD

Published: 2012-08-25

Updated: 2012-08-27

Summary

Race condition in Comodo Internet Security before 4.1.149672.916 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.

Vulnerable Configurations

Part	Description	Count
Application	Comodo Comodo Comodo Internet Security 3.0.14.276 Comodo Comodo Internet Security 3.0.15.277 Comodo Comodo Internet Security 3.0.16.295 Comodo Comodo Internet Security 3.0.17.304 Comodo Comodo Internet Security 3.0.18.309 Comodo Comodo Internet Security 3.0.19.318 Comodo Comodo Internet Security 3.0.20.320 Comodo Comodo Internet Security 3.0.22.349 Comodo Comodo Internet Security 3.0.23.364 Comodo Comodo Internet Security 3.0.24.368 Comodo Comodo Internet Security 3.0.25.378 Comodo Comodo Internet Security 3.5.53896.424 Comodo Comodo Internet Security 3.5.54375.427 Comodo Comodo Internet Security 3.5.55810.432 Comodo Comodo Internet Security 3.5.57173.439 Comodo Comodo Internet Security 3.8.64263.468 Comodo Comodo Internet Security 3.8.64739.471 Comodo Comodo Internet Security 3.8.65951.477 Comodo Comodo Internet Security 3.9.95478.509 Comodo Comodo Internet Security 3.10.102363.531 Comodo Comodo Internet Security 3.11.108364.552 Comodo Comodo Internet Security 3.12.111745.560 Comodo Comodo Internet Security 3.13.121240.574 Comodo Comodo Internet Security 3.13.125662.579 Comodo Comodo Internet Security 3.14.130099.587 Comodo Comodo Internet Security 4.0.138377.779 Comodo Comodo Internet Security 4.0.141842.828	27
OS	Microsoft Microsoft Windows XP *	1

Common Weakness Enumeration (CWE)

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Common Attack Pattern Enumeration and Classification (CAPEC)

Leveraging Race Conditions
This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References