Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile, LoadLibrary, etc. The emulator itself is located ...

Comodo AntiVirus - Heap Overflow in LZX Decompression

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=737 LzxDecoder::init initializes the vector LzxDecoder-window to a fixed size of 2^method bytes, which is then used during LzxDecoder::Extract. It's possible for LZX compressed streams to exceed this size. Writes to the window buff...

Comodo GeekBuddy Local Elevation of Privilege Vulnerability

Comodo GeekBuddy is an online computer support system from Comodo USA. Comodo GeekBuddy suffers from a local elevation of privilege vulnerability. A local attacker could use this vulnerability to gain elevated privileges and bypass the sandbox...

Comodo Anti-Virus - SHFolder.dll Local Privilege Elevation Exploit

Exploit for windows platform in category local exploits SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @LaughingMantis Greg Linares Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC: Technical Geeky Stuff GeekBuddy stores...

Comodo Anti-Virus - SHFolder.dll Local Privilege Escalation

Comodo Anti-Virus - SHFolder.dll Local Privilege Escalation ...... ,;''''''''''''''''';, .;''''''''''''''''''''''''''', :''''''''+';:,..,:;'''''''''': ,;'''''';,. ,;'''''';: :'''''',. ,'''''';. ;+''+': ,; ,''''';. ;'''';. .:;' . ;'''''. :+'''; ,:+'' ';;',''; :''''; .''''; ,';' '':' ';,''',' :'''...

Comodo Anti-Virus GeekBuddy DLL Hijacking

...... ,;''''''''''''''''';, .;''''''''''''''''''''''''''', :''''''''+';:,..,:;'''''''''': ,;'''''';,. ,;'''''';: :'''''',. ,'''''';. ;+''+': ,; ,''''';. ;'''';. .:;' . ;'''''. :+'''; ,:+'' ';;',''; :''''; .''''; ,';' '':' ';,''',' :''' .'' :'''', ;'''' ;'' :+. ;';, ';:' '''',;:+ '', ;'''' .''''...

Comodo Anti-Virus - 'SHFolder.dll' Local Privilege Escalation

...... ,;''''''''''''''''';, .;''''''''''''''''''''''''''', :''''''''+';:,..,:;'''''''''': ,;'''''';,. ,;'''''';: :'''''',. ,'''''';. ;+''+': ,; ,''''';. ;'''';. .:;' . ;'''''. :+'''; ,:+'' ';;',''; :''''; .''''; ,';' '':' ';,''',' :''' .'' :'''', ;'''' ;'' :+. ;';, ';:' '''',;:+ '', ;'''' .''''...

Comodo Chromodo Homologation Policy Security Bypass Vulnerability

Comodo Chromodo is a Chromium-based browser product. Comodo Chromodo suffers from a same-origin policy security bypass vulnerability that could be exploited by an attacker to bypass access restrictions, obtain sensitive data, or execute arbitrary code in the browser context to steal sensitive...

Tavis Ormandy Discloses Comodo GeekBuddy VNC Server

Just when you thought it was safe to dive back into the Comodo waters, Google researcher Tavis Ormandy has surfaced with more trouble. Publicly disclosed yesterday on the Google Project Zero site, Ormandy said that a tech support application called GeekBuddy installed with Comodo Internet Securit...

COMODO Cross Site Scripting

Exploit Title: COMODO Subdomain XSS Vulnerability Google Dork: N/A Date: 2016/2/3 Exploit Author: RootByte Vendor Homepage: http://personalfirewall.comodo.com/ Software Link: N/A Version: N/A Tested on: Windows 10 / FireFox 44.0 CVE : N/A about Wikipedia: COMODO is a privately held group of...

Comodo Chromodo Browsers Vulnerable to Cross-Domain Attacks

Some Comodo Chromodo browser versions 45.8.12.392, 45.8.12.391, and possibly earlier are vulnerable to cross-domain attacks. When a user of a vulnerable Chromodo browser visits a specially crafted web page, an attacker may obtain access to web content from another domain. US-CERT recommends users...

Comodo Chromodo browser with Ad Sanitizer does not enforce same origin policy and is based on an outdated version of Chromium

Overview Comodo Chromodo browser, version 45.8.12.391, and possibly earlier, bundles the Ad Sanitizer extension, version 1.4.0.26, which disables the same origin policy, allowing for the possibility of cross-domain attacks by malicious or compromised web hosts. Chromodo is based on an outdated...

Comodo Chromodo Browser Disables Same-Origin Policy

Google researcher Tavis Ormandy has disclosed that the Chromodo browser installed with Comodo Internet Security disables the same-origin policy by default. The same-origin policy is a fundamental tenet of web security, ensuring that scripts access data from a second webpage only if the two pages...

Comodo's so-called 'Secure Internet Browser' Comes with Disabled Security Features

Beware Comodo Users! Have you Safeguarded your PC with a Comodo Antivirus? Then you need to inspect your system for privacy and security concerns. First of all, make sure whether your default browser had been changed to "Chromodo" -- a free browser offered by Comodo Antivirus. If your head nod is...

Comodo, CAs Issue Forbidden Certificates

Certificate authority Comodo admits it incorrectly issued eight certificates that include forbidden internal server names or reserved IP addresses. In 2012, the Certificate Authority/Browser Forum banned the use of such designations for certs issued after Nov. 1, 2015. The decision was meant to c...

New Campaign Shows Dridex Active, Targeting the French

Two weeks after authorities announced they had taken down the botnet behind the banking malware Dridex, new research suggests the threat is alive and well. Researchers with security company Invincea announced today that they’ve noticed 60 instances of attackers dropping Dridex on users in France,...

New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe

New variants of the notorious Carbanak Trojan have surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed. Carbanak has been in use for several years, and researchers...

Design/Logic Flaw

Comodo GeekBuddy before 4.18.121 does not restrict access to the VNC server, which allows local users to gain privileges by connecting to the server...

CVE-2014-7872

Comodo GeekBuddy before 4.18.121 does not restrict access to the VNC server, which allows local users to gain privileges by connecting to the server...

CVE-2014-7872

CVE-2014-7872 affects Comodo GeekBuddy prior to 4.18.121, where the VNC server runs with lax access controls, allowing local privilege escalation by connecting to the VNC server (passwordless, background service). Some sources note a potential remote vector via CSRF-like attacks with a web-based ...