Kaspersky Lab has rolled out updates for its Internet Security and other products to address a design flaw that could have been exploited to prevent the company’s customers from accessing certain legitimate resources.
The issue, identified and reported by Google researcher Tavis Ormandy, affected “Network Attack Blocker,” a component designed to protect devices against dangerous network activity, including port scanning, denial-of-service (DoS), and buffer-overrun attacks.
After examining the feature, which is enabled by default, Ormandy determined that Network Attack Blocker is a stateless packet filter with a pattern-matching signature system, designed to blacklist the IP addresses from which the attacks originate.
One of the problems identified by the Google researcher was that the origin could be spoofed because the system did not differentiate between sequenced and unsequenced TCP packets. It also wasn’t possible to determine the application layer state when a packet was received, the expert said.
An attacker could have extracted a signature and sent it to the targeted user with a spoofed source address that matched a critical service, such as Windows Update and Kaspersky domains from which updates are downloaded.
A malicious actor could have also tricked Kaspersky users into blocking their own mail server by pasting a signature into an email. The signature could have also be embedded into the metadata of an image to get users to block certain websites.
The vulnerability was reported to Kaspersky Lab on September 11 and it was patched on October 6 via automatically updated modules.
There is no evidence that the flaw has been exploited in the wild, Kaspersky Lab told SecurityWeek.
“Kaspersky Lab has corrected the conditions for blocking IP addresses by the Network Attack Blocker component of our products that could have led to prohibiting access to legitimate network resources,” the security firm said. “We would like to thank Mr. Tavis Ormandy for reporting this vulnerability to us in a responsible manner. We greatly appreciate his effort and his findings, which were backed by the computing power of Google Project Zero.”
This is not the first time Ormandy has found a vulnerability in a Kaspersky product. Last month, the researcher reported identifying a critical security hole affecting both the 2015 and 2016 versions of Kaspersky antivirus products.
Kaspersky Lab is not the only security firm whose products have been targeted by the expert. He has also identified a remote code execution flaw in the 2015 desktop product from Avast, which the antivirus company patched roughly one week after the issue was brought to its attention.