Bitdefender has recently alerted users to critical vulnerabilities within Bitdefender Total Security and SafePay, necessitating immediate action to protect against online threats. These Bitdefender vulnerabilities are classified as high-severity risks.
Utilizing the Common Vulnerability Scoring System (CVSS), these Bitdefender vulnerabilities have been categorized based on their severity, ranging from Critical (9.0-10) to Low (0.0-3.9). The advisory identifies six high-severity vulnerabilities, each linked to a unique CVE ID: CVE-2023-6055, CVE-2023-6056, CVE-2023-6057, CVE-2023-6058, CVE-2023-49567, and CVE-2023-49570. Patches for these vulnerabilities are available through automatic updates.
Major Bitdefender Vulnerabilities
The first Bitdefender vulnerability, CVE-2023-6055, relates to improper certificate validation within Bitdefender Total Security and has a CVSS score of 8.6. This flaw allows attackers to conduct Man-in-the-Middle (MITM) attacks by exploiting the software’s failure to validate HTTPS website certificates properly.
An automatic update to version 27.0.25.115 is recommended to mitigate this risk. Another significant Bitdefender vulnerability, CVE-2023-6056, scored 8.6, arises from the software’s undue trust in self-signed certificates, particularly those using the RIPEMD-160 hashing algorithm. This flaw can enable attackers to establish SSL connections to arbitrary sites, necessitating the installation of the latest update to counter this threat.
The third vulnerability, CVE-2023-6057, is found within the HTTPS scanning functionality of Bitdefender Total Security. Like the previous vulnerabilities, it carries a severity score of 8.6, stemming from inadequate checking of the certificate chain for DSA-signed certificates, potentially allowing for MITM attacks. Users should apply the automatic update to version 27.0.25.115 to address this issue.
Additionally, CVE-2023-6058 impacts Bitdefender SafePay, where the vulnerability also has a high severity score of 8.6. This issue occurs when SafePay blocks a connection due to an untrusted server certificate but allows users to add exceptions, which can later be exploited. Users are advised to install the automatic update to secure their transactions.
CVE-2023-49567 is another critical vulnerability with a CVSS score of 8.6, caused by the software trusting certificates issued using the MD5 and SHA1 collision hash functions. This flaw can enable the creation of counterfeit certificates, making it crucial for users to update to the latest version.
Similarly, CVE-2023-49570 poses a risk by allowing Bitdefender to trust certificates from unauthorized entities, which can lead to potential MITM attacks. To protect against this vulnerability, users should ensure they install the automatic update.
Mitigation and Workarounds
To mitigate the risks associated with the Bitdefender vulnerabilities, users and organizations must prioritize timely software updates and establish a structured patch management approach. Implementing effective network segmentation, maintaining a tested incident response plan, and utilizing comprehensive monitoring solutions will enhance security.
Additionally, organizations should proactively manage End-of-Life products to minimize risks. Ultimately, staying informed and promptly addressing these Bitdefender vulnerabilities is essential for maintaining a strong cybersecurity posture and protecting digital assets from online threats.