 Topic: |
BitDefender Antivirus Filename Handling Format String Vulnerability |
| Credit: |
fRoGGz |
| Date: |
2005.10.04 |
| CWE: |
N/A |
| CVE: |
CVE-2005-3154 (Show details)
Use CVE to see details like:
- CVSS2,
- Affected Software,
- References |
| Risk |
Local |
| Remote |
| High |
Yes |
| Yes |
ISSUE:
The vulnerability is caused due to a format string error when generating the scan report file. This can potentially be
exploited to execute arbitrary code when a file or directory containing format string specifiers in its name (e.g.
%.8X%.8X) is scanned.
SOLUTION:
BitDefender was notified on September 16, 2005 by the SecuBox team on the existence of a format string vulnerability in
BitDefender products.
Fixes for BitDefender v7.x, BitDefender v8.x and BitDefender 9 Internet Security were released September 26, 2005.
Fixes for BitDefender 9 Professional Plus and BitDefender 9 Standard were released October 4, 2005.
Installed BitDefender solutions were updated automatically through the regular update function.
Source : http://kb.bitdefender.com/KB261-en--Filename-Format-String-Vulnerability.html
[ ASCII VERSION ]
|
