CVE-2021-33974
📋 TL;DR
This CVE describes a buffer overflow vulnerability in Qihoo 360 security software that allows remote code execution. Attackers can exploit it by tricking users into opening malicious links in affected browsers, potentially leading to full system compromise. The vulnerability affects Qihoo 360 Safeguard, Total Security, and Chrome/Safe Browser users.
💻 Affected Systems
- Qihoo 360 Safeguard
- Qihoo 360 Total Security
- Qihoo 360 Chrome
- Qihoo 360 Safe Browser
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with persistent malware installation that evades detection by the very security software designed to protect the system.
Likely Case
Remote code execution leading to data theft, ransomware deployment, or system compromise.
If Mitigated
Limited impact if systems are patched, use application whitelisting, and have network segmentation.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious link) but no authentication. The vulnerability chain allows remote exploitation via browser and persistence via security software flaws.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after those listed as affected
Vendor Advisory: https://www.360.cn/
Restart Required: Yes
Instructions:
1. Open Qihoo 360 software. 2. Check for updates in settings. 3. Install all available updates. 4. Restart the computer.
🔧 Temporary Workarounds
Disable affected software
windowsTemporarily disable or uninstall affected Qihoo 360 software until patched.
Use alternative browser
windowsSwitch to a different browser until Qihoo 360 Chrome/Safe Browser is updated.
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems
- Deploy application control/whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Qihoo 360 software version in About or Settings section.Check Version:
Check within Qihoo 360 software interface (no standard command-line method)Verify Fix Applied:
Verify software version is higher than affected versions listed above.📡 Detection & Monitoring
Log Indicators:
- Unexpected process creation from browser
- Qihoo 360 software crash logs
- Unusual network connections from browser processes
Network Indicators:
- Outbound connections to suspicious domains after visiting links
- Unusual traffic patterns from browser
SIEM Query:
Process creation where parent process contains '360' or 'chrome' AND command line contains suspicious parameters