PT-2017-11633 · Bitdefender · Bitdefender Internet Security

Pagefault · Published 2017-09-06 · Updated 2019-10-09 · CVE-2017-10954

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitdefender Internet Security version prior to build 7.72918

Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within pdf.xmd due to the lack of proper validation of user-supplied data, resulting in an integer overflow before allocating a buffer. An attacker can leverage this to execute code under the context of SYSTEM.

Recommendations For Bitdefender Internet Security version prior to build 7.72918, update to a version after build 7.72918 to resolve the issue. As a temporary workaround, consider restricting access to pdf.xmd to minimize the risk of exploitation. Avoid opening malicious files or visiting suspicious links to reduce the risk of attack.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2017-10954

ZDI-17-717

Affected Products

Bitdefender Internet Security

References · 4

• https://zerodayinitiative.com/advisories/ZDI-17-717 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-10954 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10954 · Vendor Advisory
• http://securityfocus.com/bid/100676 · Note