Bitdefender GravityZone Authentication Bypass and Unauthorized Access Vulnerabilities

Bugtraq ID:	68669
Class:	Design Error
CVE:	CVE-2014-5350
Remote:	Yes
Local:	No
Published:	Jul 16 2014 12:00AM
Updated:	Aug 22 2014 12:02AM
Credit:	Stefan Viehböck of the SEC Consult Vulnerability Lab.
Vulnerable:
Not Vulnerable:

Bitdefender GravityZone Authentication Bypass and Unauthorized Access Vulnerabilities

Bitdefender GravityZone is prone to an authentication-bypass vulnerability and multiple unauthorized-access vulnerabilities.

An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access to the affected application. This may aid in further attacks.

Bitdefender GravityZone Authentication Bypass and Unauthorized Access Vulnerabilities

An attacker can use readily available tools to exploit these issues.

The researcher has created a proof-of-concept to demonstrate these issues. Please see the references for more information.

Bitdefender GravityZone Authentication Bypass and Unauthorized Access Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Bitdefender GravityZone Authentication Bypass and Unauthorized Access Vulnerabilities

References:

• BitDefender Homepage (BitDefender)