Multiple Denial-of-Service (DoS) Vulnerabilities

Vulnerability

A denial-of-service (DoS) vulnerability exists in F-Secure Atlant and certain WithSecure products when scanning specially crafted PE32-bit files. The affected products are all F-Secure endpoint protection products for Windows and Mac, as well as WithSecure Atlant. The issue is triggered during file scanning, causing memory corruption and a heap buffer overflow that can crash the scanning engine. The vulnerability affects all versions of these products prior to the respective security updates released around May 2022 [1][2].

Exploitation

An attacker can remotely trigger the vulnerability by sending or making available a maliciously fuzzed PE32-bit file to a system running an affected product. The victim's system does not require any special user interaction beyond the normal scanning process; the vulnerability is activated when the scanning engine processes the malicious file. No authentication or elevated privileges are needed to deliver the file; the attacker only requires the ability to present the file to the affected scanner (e.g., via email, web download, or network share) [1][2].

Impact

Successful exploitation leads to a denial-of-service condition: the scanning engine crashes, which may cause the security product to stop functioning or enter an unstable state. This disruption can prevent the system from being protected against real threats until the engine is restarted or the product is reinstalled. There is no indication of code execution or data compromise beyond the DoS event [1][2].

Mitigation

Mitigations are available through vendor security updates. F-Secure released patches for all affected endpoint protection products for Windows and Mac, and WithSecure issued corresponding updates for its Atlant products. The exact fixed versions are listed in the respective security advisories. Users are advised to apply the latest product updates as soon as possible. No workarounds have been provided, and the vulnerabilities are not listed on the CISA KEV [1][2].