PT-2022-11519 · Bitdefender · Bitdefender Endpoint Security Tools+4

Izobashi + 1 · Published 2022-03-07 · Updated 2022-03-11 · CVE-2021-4198

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Bitdefender Total Security versions prior to 26.0.3.29 Bitdefender Internet Security versions prior to 26.0.3.29 Bitdefender Antivirus Plus versions prior to 26.0.3.29 Bitdefender Endpoint Security Tools versions prior to 7.2.2.92 Bitdefender VPN Standalone versions prior to 25.5.0.48

Description A NULL Pointer Dereference vulnerability in the messaging ipc.dll component allows an attacker to arbitrarily crash product processes and generate crashdump files.

Recommendations For Bitdefender Total Security versions prior to 26.0.3.29, update to version 26.0.3.29 or later. For Bitdefender Internet Security versions prior to 26.0.3.29, update to version 26.0.3.29 or later. For Bitdefender Antivirus Plus versions prior to 26.0.3.29, update to version 26.0.3.29 or later. For Bitdefender Endpoint Security Tools versions prior to 7.2.2.92, update to version 7.2.2.92 or later. For Bitdefender VPN Standalone versions prior to 25.5.0.48, update to version 25.5.0.48 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-4198

ZDI-22-483

Affected Products

Bitdefender Antivirus Plus

Bitdefender Endpoint Security Tools

Bitdefender Internet Security

Bitdefender Total Security

Bitdefender Vpn Standalone

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-4198 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-483 · Security Note
• https://bitdefender.com/support/security-advisories/messaging_ipc-dll-null-pointer-dereference-in-multiple-bitdefender-products-va-10016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4198 · Vendor Advisory
• https://t.me/cvenotify/27820 · Telegram Post
• https://t.me/cibsecurity/38501 · Telegram Post