A reasonable expectation of security software is that at worst it should make your system no less secure than would be without the software. Sadly, it often seems that such software fails to meet even this low bar.
Comodo Internet Security is a security suite that includes anti-virus, firewalling, and sandboxing to allow applications to be run in a notionally secure unprivileged environment. By default, it also includes a component called GeekBuddy. GeekBuddy is a VNC server, providing full remote access to your system. In May of 2015 it was pointed out that this VNC server was running without a password—yes, really—providing, at the very least, local privilege escalation. Sandboxed applications such as Google Chrome, or even those running in Comodo’s own sandbox, could connect to this VNC server and have full access to your system.
With the right (or rather, in this case, wrong) network configuration, the VNC server might even be exposed to remote attackers.
Comodo responded to this revelation by adding a password to the VNC server. Google’s Tavis Ormandy noticed in January that this password wasn’t actually worth very much. The password is computed from a handful of hard disk properties such as its name and serial number. Accessing this information isn’t privileged; apps inside the Comodo sandbox can retrieve it. Given the password, a sandboxed app can connect to the VNC server and once again have full access to the system.
This kind of elevation-of-privilege attack is also an issue for the sandboxing used by Chrome, Internet Explorer, and Edge. An attacker exploiting a flaw in those browsers may be able to attack those browsers to run their code with low privileges, but it limits their ability to harm the system or its data. The next step is typically to use a second flaw to elevate privileges and escape the constraints of the sandboxed environment. The Comodo VNC server could be used for this elevation.
Since Ormandy reported the bug to Comodo, the company has issued an update that it says addresses the vulnerability in some unspecified way.
This is not the first time that security software has created additional vulnerabilities. Over the last year, Ormandy has reported bugs in security products from MalwareBytes, Avast, TrendMicro, AVG, ESET, FireEye, and many flaws in Kaspersky software. He also reported flaws in Comodo’s “secure” browser “Chromodo” (based, as the name might suggest, on the open source parts of Chrome, Chromium). Those have since been fixed.
SOURCE: Peter Bright | Ars