PT-2025-1620 · Bitdefender · Bitdefender Virus Scanner

Publicado 2025-01-13 · Atualizado 2025-01-14 · CVE-2024-11128

Positive Technologies (AI Summary)

CVSS v4.0

8.4

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Bitdefender Virus Scanner versions prior to 3.18

Description A vulnerability in the BitdefenderVirusScanner binary may allow dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence of Hardened Runtime or Library Validation signing.

Recommendations Update to version 3.18 to resolve the issue. As a temporary workaround, consider restricting the use of the BitdefenderVirusScanner binary until a patch is applied.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2024-11128

Produtos afetados

Bitdefender Virus Scanner

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-11128 · Nota de Segurança
• https://bitdefender.com/support/security-advisories/insufficient-hardened-runtime-or-library-validation-signing-in-bitdefender-virus-scanner-for-macos · Aviso do Fabricante
• https://t.me/cvedetector/15193 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-11128 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1878928240506437926 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1878957519457911247 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1878925341453947110 · Publicação no Twitter