Vulnerability · Published Apr 7, 2022 · Assigned by Bitdefender
CVE-2022-0677Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)
High 7.5
In plain English
A high-severity security flaw in Endpoint Security Tools for Linux from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | Update Server | unspecified – before 3.4.0.276 |
| Bitdefender | GravityZone | unspecified – before 26.4-1 |
| Bitdefender | Endpoint Security Tools for Linux | unspecified – before 6.2.21.171 |
| Bitdefender | Endpoint Security Tools for Windows | unspecified – before 7.4.1.111 |
Weakness: CWE-130 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H