Denial-of-Service (DoS) Vulnerability

Vulnerability

The vulnerability resides in the aemobile component of F-Secure Atlant and certain WithSecure products. When the scanning engine processes a specially crafted file or request targeting this component, it can cause a crash, leading to denial of service. The exact affected versions are not specified in the available references, but the advisory covers all F-Secure endpoint protection products for Windows and Mac [1] and WithSecure Atlant product [2].

Exploitation

An attacker can trigger this vulnerability remotely without authentication by sending a malicious file or network request that is scanned by the vulnerable aemobile component. No user interaction is required beyond the normal scanning process.

Impact

Successful exploitation results in a denial of service, crashing the scanning engine. This can prevent the security software from detecting threats, leaving the system unprotected until the engine is restarted.

Mitigation

F-Secure and WithSecure have likely released patches; however, the specific fixed version is not disclosed in the provided references. Users should consult the official security advisories [1][2] for updates and apply the latest product updates. If no patch is available, consider temporarily disabling the aemobile component if possible, but this is not recommended.