Denial-of-Service (DoS) Vulnerability

Vulnerability

A Denial-of-Service (DoS) vulnerability exists in the AVRDL unpacking module component of F-Secure Atlant, used in certain F-Secure endpoint protection products. The module can crash while scanning a fuzzed file, leading to a DoS of the Anti-Virus engine. The vulnerability is triggered remotely by an attacker sending a specially crafted file. The affected products include all F-Secure endpoint protection products for Windows and Mac [1].

Exploitation

An attacker can exploit this vulnerability remotely by providing a fuzzed file that, when scanned by the vulnerable AVRDL unpacking module, causes the anti-virus engine to crash. No authentication is required, as the attack can be delivered via email, web download, or any vector where the file is processed by the affected F-Secure product [1].

Impact

Successful exploitation results in a Denial-of-Service (DoS) condition, where the anti-virus engine becomes unavailable, leaving the endpoint unprotected until the engine is restarted. The crash does not lead to code execution or privilege escalation, but it disrupts the security service [1].

Mitigation

F-Secure has addressed this vulnerability through automatic updates. Users should ensure their F-Secure endpoint protection products are updated to the latest version. As the fix is delivered via normal update channels, no manual workarounds are required [1].