Vulnerabilites related to Bitdefender - Endpoint Security Tools for Linux
CVE-2021-3554 (GCVE-0-2021-3554)
Vulnerability from cvelistv5
Published
2021-11-24 14:45
Modified
2024-09-16 20:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-284 - Improper Access Control
Summary
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.
References
Impacted products
Vendor | Product | Version | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Bitdefender | Endpoint Security Tools for Linux |
Version: unspecified < 6.6.27.390 Version: unspecified < 7.1.2.33 |
|||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T17:01:07.935Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Endpoint Security Tools for Linux", "vendor": "Bitdefender", "versions": [ { "lessThan": "6.6.27.390", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "lessThan": "7.1.2.33", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Unified Endpoint", "vendor": "Bitdefender", "versions": [ { "lessThan": "6.2.21.160", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "GravityZone", "vendor": "Bitdefender", "versions": [ { "lessThan": "6.24.1-1", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Nicolas VERDIER, Cybersecurity Consultant at TEHTRIS" } ], "datePublic": "2021-06-05T00:00:00", "descriptions": [ { "lang": "en", "value": "Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2021-11-24T14:45:12", "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "shortName": "Bitdefender" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825" } ], "source": { "advisory": "VA-9825", "discovery": "EXTERNAL" }, "title": "Improper Access Control vulnerability in the patchesUpdate API", "workarounds": [ { "lang": "en", "value": "An automatic update to version 6.6.27.390 fixes the issue." } ], "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve-requests@bitdefender.com", "DATE_PUBLIC": "2021-06-05T09:00:00.000Z", "ID": "CVE-2021-3554", "STATE": "PUBLIC", "TITLE": "Improper Access Control vulnerability in the patchesUpdate API" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Endpoint Security Tools for Linux", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "6.6.27.390" }, { "version_affected": "\u003c", "version_value": "7.1.2.33" } ] } }, { "product_name": "Unified Endpoint", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "6.2.21.160" } ] } }, { "product_name": "GravityZone", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "6.24.1-1" } ] } } ] }, "vendor_name": "Bitdefender" } ] } }, "credit": [ { "lang": "eng", "value": "Nicolas VERDIER, Cybersecurity Consultant at TEHTRIS" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-284 Improper Access Control" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825", "refsource": "MISC", "url": "https://www.bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825" } ] }, "source": { "advisory": "VA-9825", "discovery": "EXTERNAL" }, "work_around": [ { "lang": "en", "value": "An automatic update to version 6.6.27.390 fixes the issue." } ] } } }, "cveMetadata": { "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "assignerShortName": "Bitdefender", "cveId": "CVE-2021-3554", "datePublished": "2021-11-24T14:45:12.904727Z", "dateReserved": "2021-05-17T00:00:00", "dateUpdated": "2024-09-16T20:03:20.270Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2022-0677 (GCVE-0-2022-0677)
Vulnerability from cvelistv5
Published
2022-04-07 18:21
Modified
2024-09-16 22:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Summary
Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Bitdefender | Update Server |
Version: unspecified < 3.4.0.276 |
||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T23:40:03.188Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Update Server", "vendor": "Bitdefender", "versions": [ { "lessThan": "3.4.0.276", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "GravityZone", "vendor": "Bitdefender", "versions": [ { "lessThan": "26.4-1", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Endpoint Security Tools for Linux", "vendor": "Bitdefender", "versions": [ { "lessThan": "6.2.21.171", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Endpoint Security Tools for Windows", "vendor": "Bitdefender", "versions": [ { "lessThan": "7.4.1.111", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "datePublic": "2022-03-10T00:00:00", "descriptions": [ { "lang": "en", "value": "Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-130", "description": "CWE-130 Improper Handling of Length Parameter Inconsistency", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-04-07T18:21:34", "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "shortName": "Bitdefender" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144" } ], "solutions": [ { "lang": "en", "value": "An automatic update to the following product version fixes the issues:\n\nBitdefender Update Server version3.4.0.276.\nBitdefender GravityZone version 26.4-1.\nBitdefender Endpoint Security Tools for Linux version 6.2.21.171.\nBitdefender Endpoint Security Tools for Windows version 7.4.1.111." } ], "source": { "defect": [ "VA-10144" ], "discovery": "EXTERNAL" }, "title": "Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve-requests@bitdefender.com", "DATE_PUBLIC": "2022-03-10T10:00:00.000Z", "ID": "CVE-2022-0677", "STATE": "PUBLIC", "TITLE": "Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Update Server", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "3.4.0.276" } ] } }, { "product_name": "GravityZone", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "26.4-1" } ] } }, { "product_name": "Endpoint Security Tools for Linux", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "6.2.21.171" } ] } }, { "product_name": "Endpoint Security Tools for Windows", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "7.4.1.111" } ] } } ] }, "vendor_name": "Bitdefender" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-130 Improper Handling of Length Parameter Inconsistency" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144", "refsource": "MISC", "url": "https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144" } ] }, "solution": [ { "lang": "en", "value": "An automatic update to the following product version fixes the issues:\n\nBitdefender Update Server version3.4.0.276.\nBitdefender GravityZone version 26.4-1.\nBitdefender Endpoint Security Tools for Linux version 6.2.21.171.\nBitdefender Endpoint Security Tools for Windows version 7.4.1.111." } ], "source": { "defect": [ "VA-10144" ], "discovery": "EXTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "assignerShortName": "Bitdefender", "cveId": "CVE-2022-0677", "datePublished": "2022-04-07T18:21:34.788102Z", "dateReserved": "2022-02-18T00:00:00", "dateUpdated": "2024-09-16T22:02:25.418Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2021-3485 (GCVE-0-2021-3485)
Vulnerability from cvelistv5
Published
2021-05-24 13:30
Modified
2024-09-16 16:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-494 - Download of Code Without Integrity Check
Summary
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Bitdefender | Endpoint Security Tools for Linux |
Version: unspecified < 6.2.21.155 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T16:53:17.680Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://herolab.usd.de/security-advisories/usd-2021-0014/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Endpoint Security Tools for Linux", "vendor": "Bitdefender", "versions": [ { "lessThan": "6.2.21.155", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "datePublic": "2021-05-20T21:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAn Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.\u003c/p\u003e" } ], "value": "An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-12-20T09:15:54.577Z", "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "shortName": "Bitdefender" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769" }, { "tags": [ "x_refsource_MISC" ], "url": "https://herolab.usd.de/security-advisories/usd-2021-0014/" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAn automatic update to version 6.2.21.155 fixes the issue.\u003c/p\u003e" } ], "value": "An automatic update to version 6.2.21.155 fixes the issue." } ], "source": { "defect": [ "VA-9769" ], "discovery": "EXTERNAL" }, "title": "Improper Input Validation in Bitdefender Endpoint Security Tools for Linux", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve-requests@bitdefender.com", "DATE_PUBLIC": "2021-05-21T09:00:00.000Z", "ID": "CVE-2021-3485", "STATE": "PUBLIC", "TITLE": "Improper Input Validation in Bitdefender Endpoint Security Tools for Linux" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Endpoint Security Tools for Linux", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "6.2.21.155" } ] } } ] }, "vendor_name": "Bitdefender" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-20 Improper Input Validation" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769", "refsource": "MISC", "url": "https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769" }, { "name": "https://herolab.usd.de/security-advisories/usd-2021-0014/", "refsource": "MISC", "url": "https://herolab.usd.de/security-advisories/usd-2021-0014/" } ] }, "solution": [ { "lang": "en", "value": "An automatic update to version 6.2.21.155 fixes the issue." } ], "source": { "defect": [ "VA-9769" ], "discovery": "EXTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82", "assignerShortName": "Bitdefender", "cveId": "CVE-2021-3485", "datePublished": "2021-05-24T13:30:17.816453Z", "dateReserved": "2021-04-07T00:00:00", "dateUpdated": "2024-09-16T16:28:38.711Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }