CVE-2017-6417

Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier), Optimization Suite 15.0 (and earlier), Internet Security Suite 15.0 (and earlier), and Free Security Suite 15.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avira process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

• CWE-427

• http://cybellum.com/doubleagent-taking-full-control-antivirus/Third Party Advisory
• http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/Technical Description, Third Party Advisory
• http://www.securityfocus.com/bid/97021Third Party Advisory, VDB Entry
• http://cybellum.com/doubleagent-taking-full-control-antivirus/Third Party Advisory
• http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/Technical Description, Third Party Advisory
• http://www.securityfocus.com/bid/97021Third Party Advisory, VDB Entry

Published

Mar 21, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6411Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_…
• CVE-2017-6412In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixati…
• CVE-2017-6413The "OpenID Connect Relying Party and OAuth 2.0 Resource Ser…
• CVE-2017-6414Memory leak in the vcard_apdu_new function in card_7816.c in…6.5
• CVE-2017-6415The dex_parse_debug_item function in libr/bin/p/bin_dex.c in…5.5
• CVE-2017-6416An issue was discovered in SysGauge 1.5.18. A buffer overflo…
• CVE-2017-6418libclamav/message.c in ClamAV 0.99.2 allows remote attackers…
• CVE-2017-6419mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.…
• CVE-2017-6420The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99…
• CVE-2017-6421In the touch controller function in all Qualcomm products wi…
• CVE-2017-6423An elevation of privilege vulnerability in the Qualcomm kyro…
• CVE-2017-6424An elevation of privilege vulnerability in the Qualcomm WiFi…