Back to CVE Browser

CVE-2018-8955

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0640%

EPSS Percentile28.87th

PublishedOct 24, 2018

Last ModifiedNov 21, 2024

Vulnerability Description

The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file's digital signature unchanged.

Affected Platforms (CPE)

📦

Bitdefender

Gravityzone

All versions

References & Advisories

🔗 http://packetstormsecurity.com/files/149900/Bitdefender-GravityZone-Installer-Signature-Bypass-Code-Execution.html

🔗 http://seclists.org/fulldisclosure/2018/Oct/44

🔗 http://www.securitytracker.com/id/1041940

🔗 https://labs.nettitude.com/blog/cve-2018-8955-bitdefender-gravityzone-arbitrary-code-execution/

🔗 http://packetstormsecurity.com/files/149900/Bitdefender-GravityZone-Installer-Signature-Bypass-Code-Execution.html

🔗 http://seclists.org/fulldisclosure/2018/Oct/44

🔗 http://www.securitytracker.com/id/1041940

🔗 https://labs.nettitude.com/blog/cve-2018-8955-bitdefender-gravityzone-arbitrary-code-execution/

Related Vulnerabilities

CVE-2017-89319.8

Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified...

CVE-2021-35549.0

Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as ...

CVE-2021-34237.8

Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allow...

CVE-2021-38237.1

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitd...