PT-2020-9874 · Bitdefender · Bitdefender Box 2

Mongo · Published 2020-01-27 · Updated 2020-02-03 · CVE-2019-17102

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitdefender BOX 2 versions prior to 2.1.47.36

Description An exploitable command execution issue exists in the recovery partition due to a race condition in the /api/update setup API endpoint. This allows arbitrary execution of system commands because the API method does not perform firmware signature checks atomically, leading to a Time-of-Check-to-Time-of-Use (TOCTTOU) vulnerability.

Recommendations For Bitdefender BOX 2 versions prior to 2.1.47.36, update to version 2.1.47.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the /api/update setup API endpoint until the update can be applied.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

CWE-413

Related Identifiers

CVE-2019-17102

Affected Products

Bitdefender Box 2

References · 3

• https://osv.dev/vulnerability/CVE-2019-17102 · Vendor Advisory
• https://bitdefender.com/support/security-advisories/bitdefender-box-v2-bootstrap-update_setup-command-execution-vulnerability-va-2226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17102 · Security Note