Last week it was Trend Micro and Kaspersky. This week it's Bitdefender's turn to disclose a security vulnerability of its own.
Bitdefender Antivirus Free 2020 until today (Aug. 21) had a flaw that permitted malicious code injection by malware or a human attacker, resulting in full system takeover.
Users of Bitdefender Antivirus Free should install the update to version 1.0.15.138, which was pushed out to client machines today. Other Bitdefender antivirus products are not affected.
The flaw gives an attacker "the ability to operate as NT AUTHORITY\SYSTEM which is the most powerful user in Windows, so he can access almost every file and process which belongs to the user on the computer," SafeBreach researcher Peleg Hadar wrote in a company blog posting describing the flaw.
As with last week's Trend Micro flaw, this flaw permits DLL hijacking, an indirect way of sneaking malicious code into an already installed program.
Dynamic link libraries (DLLs) are repositories of code that, to avoid duplication, are shared by different programs. Applications pull code from DLLs are they run, with many different programs often retrieving code from the same DLL.
DLL hijacking generally involves creating fake DLLs so that a program pulls code from that repository instead, infecting the process. It's a well-known attack method that works on Macs as well as Windows PCs, so it's not clear how this fairly obvious flaw (in retrospect, anyway) got past the Bitdefender developers.
Bitdefender's antivirus programs, including Bitdefender Antivirus Free, are supposed to be protecting their files with something called Code Integrity Guard (CIG), which allows only digitally "signed" software to run in crucial parts of the operating system. Somehow, wrote Hadar, "CIG ... is not enforced, so unsigned code loading is possible into these processes."
We'll skip the more technical details, but suffice it to say that you should update your Bitdefender Antivirus Free software, if it hasn't already updated itself, to version 1.0.15.138.
