CVE-2021-3485: Improper Input Validation in Bitdefender Endpoint Security Tools for Linux
First published: Mon May 24 2021(Updated: )
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.
Credit: cve-requests@bitdefender.com cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender Endpoint Security Tools | <6.2.21.155 |
Remedy
An automatic update to version 6.2.21.155 fixes the issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-3485?
CVE-2021-3485 is an Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux.
How does CVE-2021-3485 affect Bitdefender Endpoint Security Tools for Linux?
CVE-2021-3485 allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution.
What is the severity of CVE-2021-3485?
The severity of CVE-2021-3485 is medium with a CVSS score of 6.6.
How can I fix CVE-2021-3485?
Apply the necessary updates provided by Bitdefender to address the vulnerability.
Are there any references for CVE-2021-3485?
Yes, you can find more information about CVE-2021-3485 in the following references: [link1](https://herolab.usd.de/security-advisories/usd-2021-0014/) [link2](https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769)
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/author
- agent/title
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/event
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/bitdefender
- canonical/bitdefender endpoint security tools