A vulnerability has been identified in Bitdefender Antivirus Free 2020 that allows an attacker to load unsigned code that could lead to privilege escalation.
According to Safebreach, the main issue with this product is that the code integrity mechanism is not triggered, allowing an attacker to load unsigned code. The risk here is particularly high because the software runs as NT AUTHORITY\SYSTEM, the most privileged user account, making this access very important for an unauthorized person.
"The vulnerability allows hackers to load and execute malicious payloads using a service. This capability can be exploited by an attacker, for example to achieve an Application Whitelisting Bypass for purposes such as execution and tax evasion," Safebreach says.
The main causes behind the vulnerability are the lack of safe DLL due to the existence of an uncontrolled search path and the lack of digital certificate validation against the binary.
Safebreach reported the issue to Bitdefender on July 17. The company responded immediately and was able to confirm the issue by August 14. Five days later, BitDefender published an advisory and confirmed CVE-2019-15295.
Bitdefender told SC Media that the issue was submitted by Safebreach through the company's bug bounty program.
“We were made aware of the issue and published our own advisory on our website. The issue has been fixed and we automatically updated our customer base before the releases were published. We started our bug bounty program two years ago to increase the security and reliability of the code base and offer the best security to our customers,” said Bogdan “Bob” Botezatu, Director of Threat Research and Reporting at Bitdefender.
