PT-2019-3092 · Bitdefender · Bitdefender Antivirus Free 2020+1

Published 2019-08-21 · Updated 2019-08-28 · CVE-2019-15295

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138 ServiceInstance.dll library versions 1.0.15.119 and lower

Description The issue is related to errors in checking the path of loaded dynamic libraries in the ServiceInstance.dll library of Bitdefender Antivirus Free 2020. Exploitation of this issue may allow an attacker to elevate their privileges. An Untrusted Search Path vulnerability allows an attacker to load an arbitrary DLL file from the search path.

Recommendations For Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, update to version 1.0.15.138 or later to resolve the issue. For ServiceInstance.dll library versions 1.0.15.119 and lower, update to a version higher than 1.0.15.119 to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2019-03075

CVE-2019-15295

Affected Products

Bitdefender Antivirus Free 2020

Serviceinstance.Dll

References · 6

• https://bdu.fstec.ru/vul/2019-03075 · Security Note
• https://bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-serviceinstance-dll-bitdefender-antivirus-free-2020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15295 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15295 · Vendor Advisory
• https://safebreach.com/Post/BitDefender-Antivirus-Free-2020-Privilege-Escalation-to-SYSTEM · Note
• http://safe.cnews.ru/news/top/2019-08-26_besplatnyj_antivirus_pod · Note