Connect with us

Hi, what are you looking for?



Kaspersky Patches Flaw in “Network Attack Blocker” Feature

Kaspersky Lab has rolled out updates for its Internet Security and other products to address a design flaw that could have been exploited to prevent the company’s customers from accessing certain legitimate resources.

Kaspersky Lab has rolled out updates for its Internet Security and other products to address a design flaw that could have been exploited to prevent the company’s customers from accessing certain legitimate resources.

The issue, identified and reported by Google researcher Tavis Ormandy, affected “Network Attack Blocker,” a component designed to protect devices against dangerous network activity, including port scanning, denial-of-service (DoS), and buffer-overrun attacks.

After examining the feature, which is enabled by default, Ormandy determined that Network Attack Blocker is a stateless packet filter with a pattern-matching signature system, designed to blacklist the IP addresses from which the attacks originate.

One of the problems identified by the Google researcher was that the origin could be spoofed because the system did not differentiate between sequenced and unsequenced TCP packets. It also wasn’t possible to determine the application layer state when a packet was received, the expert said.

An attacker could have extracted a signature and sent it to the targeted user with a spoofed source address that matched a critical service, such as Windows Update and Kaspersky domains from which updates are downloaded.

A malicious actor could have also tricked Kaspersky users into blocking their own mail server by pasting a signature into an email. The signature could have also be embedded into the metadata of an image to get users to block certain websites.

The vulnerability was reported to Kaspersky Lab on September 11 and it was patched on October 6 via automatically updated modules.

Advertisement. Scroll to continue reading.

There is no evidence that the flaw has been exploited in the wild, Kaspersky Lab told SecurityWeek.

“Kaspersky Lab has corrected the conditions for blocking IP addresses by the Network Attack Blocker component of our products that could have led to prohibiting access to legitimate network resources,” the security firm said. “We would like to thank Mr. Tavis Ormandy for reporting this vulnerability to us in a responsible manner. We greatly appreciate his effort and his findings, which were backed by the computing power of Google Project Zero.”

This is not the first time Ormandy has found a vulnerability in a Kaspersky product. Last month, the researcher reported identifying a critical security hole affecting both the 2015 and 2016 versions of Kaspersky antivirus products.

Kaspersky Lab is not the only security firm whose products have been targeted by the expert. He has also identified a remote code execution flaw in the 2015 desktop product from Avast, which the antivirus company patched roughly one week after the issue was brought to its attention.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.