CVE-2018-8955 | BDVDB-2026-108752 Detail

Description#

The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file's digital signature unchanged.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://packetstormsecurity.com/files/149900/Bitdefender-GravityZone-Installer-Signature-Bypass-Code-Execution.html
https://labs.nettitude.com/blog/cve-2018-8955-bitdefender-gravityzone-arbitrary-code-execution/
http://seclists.org/fulldisclosure/2018/Oct/44
http://www.securitytracker.com/id/1041940

Exploit#

No public exploit known

History#

Version 12018-10-24Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.