CVE-2021-4198: Bitdefender Total Security Link Following Denial-of-Service Vulnerability
A NULL Pointer Dereference vulnerability in the messagingipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.
Other sources
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Bitdefender Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Bitdefender Virus Shield. By creating a symbolic link, an attacker can abuse the service to delete files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
— ZDI
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-4198?
CVE-2021-4198 is a NULL Pointer Dereference vulnerability in Bitdefender Total Security and other Bitdefender products.
How does CVE-2021-4198 affect Bitdefender Total Security?
CVE-2021-4198 allows an attacker to crash product processes and generate crashdump files in Bitdefender Total Security.
What is the severity of CVE-2021-4198?
CVE-2021-4198 has a severity rating of 6.1 (Medium).
How can I fix CVE-2021-4198 vulnerability in Bitdefender Total Security?
To fix the CVE-2021-4198 vulnerability, users should update Bitdefender Total Security and affected Bitdefender products to the latest version available.
Are there any references for CVE-2021-4198?
Yes, you can find references for CVE-2021-4198 at the following links: [Reference 1](https://www.bitdefender.com/support/security-advisories/messaging_ipc-dll-null-pointer-dereference-in-multiple-bitdefender-products-va-10016/) and [Reference 2](https://www.zerodayinitiative.com/advisories/ZDI-22-483/).