cnvd - cnvd-2017-38113

CNVD-2017-38113

Vulnerability from cnvd - Published: 2017-12-26

Title

Bitdefender Internet Security整数溢出漏洞（CNVD-2017-38113）

Description

BitDefender Internet Security是可提供多种防护功能的安全软件。 Bitdefender Internet Security中的cevakrnl.xmd文件存在整数溢出漏洞，该漏洞是由于程序未能充分的验证用户提供的数据。远程攻击者借助恶意的页面或文件利用该漏洞执行任意代码。

Severity

中

Patch Name

Bitdefender Internet Security整数溢出漏洞（CNVD-2017-38113）的补丁

Patch Description

BitDefender Internet Security是可提供多种防护功能的安全软件。 Bitdefender Internet Security中的cevakrnl.xmd文件存在整数溢出漏洞，该漏洞是由于程序未能充分的验证用户提供的数据。远程攻击者借助恶意的页面或文件利用该漏洞执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://www.bitdefender.com/

Reference

http://www.zerodayinitiative.com/advisories/ZDI-17-943

Impacted products

Name
BitDefender Internet Security 2018

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-17409"
    }
  },
  "description": "BitDefender Internet Security\u662f\u53ef\u63d0\u4f9b\u591a\u79cd\u9632\u62a4\u529f\u80fd\u7684\u5b89\u5168\u8f6f\u4ef6\u3002\r\n\r\nBitdefender Internet Security\u4e2d\u7684cevakrnl.xmd\u6587\u4ef6\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u6570\u636e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u501f\u52a9\u6076\u610f\u7684\u9875\u9762\u6216\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Pagefault",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.bitdefender.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-38113",
  "openTime": "2017-12-26",
  "patchDescription": "BitDefender Internet Security\u662f\u53ef\u63d0\u4f9b\u591a\u79cd\u9632\u62a4\u529f\u80fd\u7684\u5b89\u5168\u8f6f\u4ef6\u3002\r\n\r\nBitdefender Internet Security\u4e2d\u7684cevakrnl.xmd\u6587\u4ef6\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u6570\u636e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u501f\u52a9\u6076\u610f\u7684\u9875\u9762\u6216\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Bitdefender Internet Security\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2017-38113\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "BitDefender Internet Security 2018"
  },
  "referenceLink": "http://www.zerodayinitiative.com/advisories/ZDI-17-943",
  "serverity": "\u4e2d",
  "submitTime": "2017-12-19",
  "title": "Bitdefender Internet Security\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2017-38113\uff09"
}

CVE-2017-17409 (GCVE-0-2017-17409)

Vulnerability from cvelistv5 – Published: 2017-12-21 14:00 – Updated: 2024-08-05 20:51

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x10A in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5102.

Severity ?

No CVSS data available.

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

zdi

References

URL

Tags

https://zerodayinitiative.com/advisories/ZDI-17-943

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Bitdefender	Bitdefender Internet Security	Affected: 2018

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:51:31.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://zerodayinitiative.com/advisories/ZDI-17-943"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Bitdefender Internet Security",
          "vendor": "Bitdefender",
          "versions": [
            {
              "status": "affected",
              "version": "2018"
            }
          ]
        }
      ],
      "datePublic": "2017-12-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x10A in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5102."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190-Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-21T13:57:01",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://zerodayinitiative.com/advisories/ZDI-17-943"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2017-17409",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Bitdefender Internet Security",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2018"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Bitdefender"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within emulator 0x10A in cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5102."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190-Integer Overflow or Wraparound"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://zerodayinitiative.com/advisories/ZDI-17-943",
              "refsource": "MISC",
              "url": "https://zerodayinitiative.com/advisories/ZDI-17-943"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2017-17409",
    "datePublished": "2017-12-21T14:00:00",
    "dateReserved": "2017-12-05T00:00:00",
    "dateUpdated": "2024-08-05T20:51:31.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-38113

CVE-2017-17409 (GCVE-0-2017-17409)

Tags

Sightings

Nomenclature