CVE-2022-0677 - Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)

Back Back to CVE browser

HIGH

Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)

Published Apr 7, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.25%

Description

Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.

Affected products

Vendor Bitdefender Product Endpoint Security Tools for Linux Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.2.21.171
Vendor Bitdefender Product Endpoint Security Tools for Windows Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <7.4.1.111
Vendor Bitdefender Product GravityZone Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <26.4-1
Vendor Bitdefender Product Update Server Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <3.4.0.276

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bitdefender

Endpoint Security Tools for Linux

n/a

Version	Status	Constraints
unspecified	affected	<6.2.21.171

Bitdefender

Endpoint Security Tools for Windows

n/a

Version	Status	Constraints
unspecified	affected	<7.4.1.111

Bitdefender

GravityZone

n/a

Version	Status	Constraints
unspecified	affected	<26.4-1

Bitdefender

Update Server

n/a

Version	Status	Constraints
unspecified	affected	<3.4.0.276

Remediation

Vendor solution

An automatic update to the following product version fixes the issues:

Bitdefender Update Server version3.4.0.276. Bitdefender GravityZone version 26.4-1. Bitdefender Endpoint Security Tools for Linux version 6.2.21.171. Bitdefender Endpoint Security Tools for Windows version 7.4.1.111.

Weaknesses (1)

CWE-130

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15763
Advisory
https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15763		Advisory
https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144		x_refsource_MISCVendor Advisory