So…this is something you really want to know, and thanks to Tomer Bitton and Udi Yavo, you can find out for free. The reason you want to find out is that RWX vulnerabilities are the worst…since they allow remote code execution. Also, AVs aren’t the only target. Data Leak Preventers (DLPs) are also. There are 400 million AV users, so…there might be many folks with a false sense of security. Tomer and Udi’s freebie will check any AV you are using for this vulnerability.
The company found the vulnerability in several antivirus products including McAfee Virus Scan for Enterprise version 8.8, Kaspersky Total Security 2015 and AVG Internet Security 2015. Both AVG and McAfee appear to have fixed the issue in recent updates already.” – gHacks
The vulnerability?
“The vulnerable Anti-Virus products allocate a memory page with Read, Write, Execute (RWX) permissions at a constant predictable address. This allocation occurs for various user-mode processes belonging to third party applications such as browsers and Adobe Reader.
As mentioned in our March AVG release, this flaw significantly diminishes the efforts that the threat actor needs in order to exploit a third party application. In turn, this can lead to the compromise of the underlying Windows system.
How? Microsoft places many Windows mitigations against exploits, for instance the randomization of memory (ASLR) and preventing data from running in memory (DEP). Since the memory page is at a constant predictable address, the attacker can know where to write and run the code. With the memory allocation set to RWX, that code can be executed, essentially defeating those hurdles that Windows placed in front of threat actors.” – enSilo
You can pick the freebie up here: https://github.com/BreakingMalware/AVulnerabilityChecker
So…you extract the zip and then open the .exe. Close your browser, and open at least two tabs. You’ll get an instant report in the DOS window.
Worth every cent…yeah, it’s free, but honestly I recommend running the test on your AV.
Sources:
http://www.ghacks.net/2015/12/10/check-whether-your-antivirus-is-vulnerable-to-explotable-rwx-addresses/
http://blog.ensilo.com/the-av-vulnerability-that-bypasses-mitigations