Comodo firewall says: Overflow Attack

iimu

Hi!

I purchased JVPowerTools16 v. 2011. I try to open it but Comodo firewall give message which told I should contact to vendor and tell they should fix that problem. See attachment.

iimu

redseujac

It's obviously a false positive. Comodo should be informed and take the necessary measures to stop the message.

jv16

Does this happen when you simply start jv16 PowerTools, or does this happen when you try to use a specific tool of PowerTools?

lasse88

I get the same alert from Comodo Internet Security, when i start jv16 Powertools 2011

lasse88

Will this be fixed?

leonardo

lasse88 wrote
Will this be fixed?

Like redseujac said in http://www.macecraft.com/phpBB3/viewtopic.php?f=28&t=4328#p27676 a false positive must be fixed by Comodo. In the meantime you could use the 'skip' function

lasse88

I am pretty sure it's not a false positive, i don't even know how it can be a false positive, as it have nothing to do with the Antivirus part of Comodo.

And unless Macecraft checks their program for bad coding, and come with a response, i won't change my mind.

"In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory."

leonardo

lasse88 wrote
I am pretty sure it's not a false positive, i don't even know how it can be a false positive.

And unless Macecraft checks their program for bad coding, and come with a response, i won't change my mind.

"In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory."

Well than, lets wait for the reaction of the developer.

However the Comodo error message said: "Buffer overflow attack" not "Buffer overflow error"!

If you select 'SKIP' in Comodo, does the jv16PT application continue or does it end with an 'buffer overflow' application error?

redseujac

It's rather strange only the Comodo firewall doesn't like PowerTools. No news from other ones.

lasse88

redseujac wrote
It's rather strange only the Comodo firewall doesn't like PowerTools. No news from other ones.

Please name those "other ones", that can detect buffer overflow?

Buffer overflow can be used by malware to bypass security software, so it is actually kinda funny, that almost none can detect/prevent it.

ex the "Confiker" virus spread using Buffer Overflow

jv16

lasse88 wrote

"In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory."

Sounds like a false detection, hopefully Comodo fixes this.

lasse88

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

redseujac

Well, I had already written it looked like a false positive (= detection) and Comodo had to fix it

Just look at this post.

Then you didn't agree with me, but now the developer answers the same way, it's OK and you make a thread at the Comodo forums :?

What's more in the answer from the developer than in mine?

lasse88

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

lasse88

The information so far at the Comodo forums seems like it's a not a FP, so i guess we are stuck until whoever is wrong, fix it.

A guy at their forums explained a BO a little better to me:

a buffer over flow is not a false detection. What is has to do is with how JV16 built their software and how it is acting in memory. It must be doing something that is triggering the Buffer overflow detection of Comodo, almost no other software does that so they have to fix their program and how it accesses the memory or programs in memory to stop the alert. Comodo cannot do anything to fix their program, all you can do is add it to exclusion till JV16 fixes it.

think of the BO as a guard for the ram. There are no definitions or anything like that. It watches how programs behave in memory, if the program running does something in memory it should not do, it will pop up and tell you. The only time I have seen BO pop ups is from malware or very poorly programed software. (usually games)

tullik

For one example, as long jv16PT.exe gets occasional Access Violations (which it does), the possibility that it sometime overlays memory exists.

There can be other symptoms, or no symptoms at all. It depends on what (and whose) memory is overlaid.

I think it is likely that Comodo is right.

jv16

lasse88 wrote
The information so far at the Comodo forums seems like it's a not a FP, so i guess we are stuck until whoever is wrong, fix it.

A guy at their forums explained a BO a little better to me:

a buffer over flow is not a false detection. What is has to do is with how JV16 built their software and how it is acting in memory. It must be doing something that is triggering the Buffer overflow detection of Comodo, almost no other software does that so they have to fix their program and how it accesses the memory or programs in memory to stop the alert. Comodo cannot do anything to fix their program, all you can do is add it to exclusion till JV16 fixes it.

think of the BO as a guard for the ram. There are no definitions or anything like that. It watches how programs behave in memory, if the program running does something in memory it should not do, it will pop up and tell you. The only time I have seen BO pop ups is from malware or very poorly programed software. (usually games)

This is most likely an incompatibility issue between Comodo and the software protection system (VMProtect) used by PowerTools.

sajack

Hi:

I ran into the same problem after my initial install of jv16 2011. Initially the jv16 shortcut was on the startup programs (prior to clicking all programs). When I started the program, I gut the usual UAC message, clicked yes, and nothing happened. I did this a couple of more times. Then I went back to the Start Menu, clicked "All Programs", found the jv16 folder, opened, then clicked the program. Same UAC message, clicked yes, then I got the referenced message from Comodo CIS. I told it to skip, and then proceeded to load the program. Since then, I've had NO issues with Comodo with respect to jv16. I did indicate to Comodo that jv16 was a "trusted" file. I do see a few instances in the Comodo /Defense+ logs showing jv16 accessing memory from Comodo's cfp.exe file. No problem; and this notation can be stopped in the logs by changing the Defense+ rules on memory access.