PT-2021-20962 · Bitdefender · Bitdefender Gravityzone+2

Published 2021-11-24 · Updated 2022-04-25 · CVE-2021-3554

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390 Bitdefender Endpoint Security Tools for Linux versions prior to 7.1.2.33 Bitdefender Unified Endpoint versions prior to 6.2.21.160 Bitdefender GravityZone versions prior to 6.24.1-1

Description: The issue is related to an Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role. This allows an attacker to manipulate the remote address used for pulling patches.

Recommendations: For Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390, update to version 6.6.27.390 or later. For Bitdefender Endpoint Security Tools for Linux versions prior to 7.1.2.33, update to version 7.1.2.33 or later. For Bitdefender Unified Endpoint versions prior to 6.2.21.160, update to version 6.2.21.160 or later. For Bitdefender GravityZone versions prior to 6.24.1-1, update to version 6.24.1-1 or later. As a temporary workaround, consider restricting access to the patchesUpdate API until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-3554

Affected Products

Bitdefender Endpoint Security Tools For Linux

Bitdefender Gravityzone

Bitdefender Unified Endpoint

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-3554 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3554 · Vendor Advisory
• https://t.me/cvenotify/23730 · Telegram Post
• https://bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825 · Note
• https://t.me/cibsecurity/32946 · Telegram Post