BitDefender fixes bug allowing attackers to run commands remotely

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/bitdefender-fixes-bug-allowing-attackers-to-run-commands-remotely/

Security solutions are designed to keep an organization safe, but that models crumble when that same software becomes a threat vector for the attackers to exploit.

Such is the case with a new Bitdefender remote code execution vulnerability, dubbed CVE-2020-8102, lurking in its Safepay browser component.

"Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116," an advisory published stated disclosed.

In a disclosure by Wladimir Palant, a security blogger and the original developer of the AdBlock Plus extension, a vulnerability was discovered in how Bitdefender protects users from invalid certificates.

As a part of the solution to overall system security, Bitdefender acts as a Man-in-the-Middle (MitM) proxy to inspect secure HTTPS connections.
This behavior is commonly employed by almost all antivirus vendors and is commonly referred to as Safe Search, Web Protection, Web Access Protection, etc.

 

[SeriousHoax]

Point to be taken from the article:

Unless one is super sure when playing Man-in-the-Middle (MitM), it is probably a good idea to leave encrypted connections alone: as they were meant to be.

 

[MacDefender]

Point to be taken from the article:

Yeah I completely agree, honestly. Yes, HTTPS encryption MITM can result in some malware being busted when they try to download their next stage payload. But that's arguably low hanging fruit for malware. Instead of HTTPS, just replace that with a password exchange and then download of an encrypted zip file. Boom, bypasses all SSL interception based scanning.

These kinds of unfortunate bugs aside, just the mere act of validating SSL certificates is not exactly easy. I have to trust my web browser can do it acceptably. I'd prefer not to have to trust another piece of software to do it.

Another price to pay is that after this interception, my web browser no longer shows the actual SSL certificate for me to inspect manually. That makes it harder for me to closely inspect whether a site is reputable or is phishing.