PT-2022-11521 · Bitdefender · Bitdefender Total Security+3

Izobashi + 1 · Published 2022-03-07 · Updated 2022-03-11 · CVE-2021-4199

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bitdefender Total Security versions prior to 26.0.10.45 Bitdefender Internet Security versions prior to 26.0.10.45 Bitdefender Antivirus Plus versions prior to 26.0.10.45 Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146

Description The issue is related to an Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe. This vulnerability allows a remote attacker to escalate local privileges to SYSTEM.

Recommendations For Bitdefender Total Security versions prior to 26.0.10.45, update to version 26.0.10.45 or later. For Bitdefender Internet Security versions prior to 26.0.10.45, update to version 26.0.10.45 or later. For Bitdefender Antivirus Plus versions prior to 26.0.10.45, update to version 26.0.10.45 or later. For Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146, update to version 7.4.3.146 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-4199

ZDI-22-484

Affected Products

Bitdefender Antivirus Plus

Bitdefender Endpoint Security Tools For Windows

Bitdefender Internet Security

Bitdefender Total Security

References · 6

• https://zerodayinitiative.com/advisories/ZDI-22-484 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4199 · Security Note
• https://bitdefender.com/support/security-advisories/incorrect-permission-assignment-for-critical-resource-vulnerability-in-bdreinit-exe-va-10017 · Vendor Advisory
• https://t.me/cvenotify/27819 · Telegram Post
• https://t.me/cibsecurity/38500 · Telegram Post