Anti-virus software does not make full use of Windows exploit protection features

Krebs was prompted to take a close look at anti-virus products following research published by security firm Secunia four weeks ago, which found that hardly any of 16 popular applications examined in the research, including browsers, media players and office applications, utilised Windows exploit protection features. Security products are the first place you would expect to see these used – especially as it isn't that rare for anti-virus software to itself contain vulnerabilities. Although it's possible to get around DEP and ASLR, it does raise the bar for successful exploits.

Krebs checked to see whether various anti-virus products were using DEP and ASLR under Windows Vista (XP does not support ASLR) using Windows'Process Explorer. He found that AVAST Home Edition, AVG Internet Security 9.0, BitDefender Internet Security 2010, ESET Smart Security, F-Secure Internet Security, Norton Internet Security 2010, Panda Internet Security 2010 and Trend Micro Internet Security 2010 do not use either DEP or ASLR. Only Microsoft Security Essentials activates both DEP and ASLR for its processes. Other vendors, such as Avira, McAfee and Kaspersky fail to activate these protective mechanisms consistently for all processes.

According to Krebs, F-Secure and BitDefender are intending to implement support for DEP and ASLR in future versions. Avira also plans to do so in version 11 of its product, as it will no longer support Windows 2000 which has neither DEP or ASLR. Panda does not use DEP or ASLR because it has implemented its own protection mechanism. According to Symantec, DEP at least should already be active in Norton, with ASLR to follow in future versions. ESET, on the other hand, considers Windows' exploit protection features to be inadequate, stating that without sufficient testing ASLR offers an additional attack surface.

Source:

http://www.h-online.com/security/