PT-2017-16934 · Bitdefender · Bitdefender Antivirus Plus+2

Published 2017-03-21 · Updated 2019-10-03 · CVE-2017-6186

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitdefender Total Security versions prior to 12.0 Bitdefender Internet Security versions prior to 12.0 Bitdefender Antivirus Plus versions prior to 12.0

Description A code injection issue allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Bitdefender process via a "DoubleAgent" attack. This is possible because the products do not use the Protected Processes feature, allowing an attacker to enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry. The self-protection mechanism, intended to block local processes from modifying Image File Execution Options, can be bypassed by temporarily renaming Image File Execution Options during the attack.

Recommendations For Bitdefender Total Security versions prior to 12.0, update to a version that includes the fix for this issue. For Bitdefender Internet Security versions prior to 12.0, update to a version that includes the fix for this issue. For Bitdefender Antivirus Plus versions prior to 12.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the registry to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-6186

Affected Products

Bitdefender Antivirus Plus

Bitdefender Internet Security

Bitdefender Total Security

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6186 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6186 · Vendor Advisory
• http://cybellum.com/doubleagent-taking-full-control-antivirus · Note
• http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique · Note
• http://securityfocus.com/bid/97024 · Note