CVE-2020-10860
📋 TL;DR
This vulnerability in Avast Antivirus allows attackers to overwrite arbitrary memory addresses in the aswAvLog logging library, causing denial of service to the Avast Service (AvastSvc.exe). It affects Avast Antivirus users running versions before 20. The vulnerability can be exploited locally to crash the antivirus service.
💻 Affected Systems
- Avast Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service of Avast antivirus protection, potentially allowing malware to execute without detection while the service is down.
Likely Case
Local denial of service attack that crashes the Avast service, temporarily disabling antivirus protection until system restart.
If Mitigated
Minimal impact if patched; antivirus continues to function normally with proper memory protections.
🎯 Exploit Status
Exploitation requires local access to the system. Proof of concept code is available in public disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 20 and later
Vendor Advisory: https://forum.avast.com/index.php?topic=232420.0
Restart Required: Yes
Instructions:
1. Open Avast Antivirus. 2. Go to Menu → Settings → Update. 3. Click 'Update' to check for updates. 4. Install any available updates. 5. Restart your computer when prompted.
🔧 Temporary Workarounds
Disable Avast Service (Not Recommended)
windowsTemporarily disable the Avast service to prevent exploitation, but this leaves the system unprotected.
sc stop AvastSvc
sc config AvastSvc start= disabled
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access to systems
- Monitor for Avast service crashes and investigate any unexpected service terminations
🔍 How to Verify
Check if Vulnerable:
Check Avast version in the application or via 'wmic product where name="Avast Antivirus" get version'Check Version:
wmic product where name="Avast Antivirus" get versionVerify Fix Applied:
Verify Avast version is 20.0.0 or higher and check that AvastSvc.exe is running normally📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes of AvastSvc.exe in Windows Event Logs
- Application errors related to aswAvLog.dll
Network Indicators:
- No specific network indicators as this is a local vulnerability
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="AvastSvc.exe"🔗 References
- https://forum.avast.com/index.php?topic=232420.0
- https://forum.avast.com/index.php?topic=232423.0
- https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
- https://forum.avast.com/index.php?topic=232420.0
- https://forum.avast.com/index.php?topic=232423.0
- https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
