Denial-of-Service (DoS) Vulnerability

Vulnerability

A Denial-of-Service (DoS) vulnerability exists in F-Secure Atlant and certain WithSecure products whereby scanning a specially crafted file can crash the scanning engine. The flaw resides in the aepack.dll component. Affected versions are not explicitly disclosed, but the vulnerability impacts all F-Secure Atlant and relevant WithSecure products [1][2].

Exploitation

An attacker can exploit this vulnerability by delivering a malicious file that, when scanned by the affected product, triggers the crash. No authentication or special privileges are required; the attack is remotely exploitable if the attacker can cause the target to scan the file (e.g., via email, web download, or file share).

Impact

Successful exploitation causes the scanning engine to crash, resulting in a denial of service. This prevents the software from detecting subsequent threats until the engine is manually restarted or the system recovers, potentially leaving the system unprotected.

Mitigation

F‑Secure and WithSecure have not yet released a specific patch for this CVE in the provided references. Users should monitor the vendor security advisory pages [1][2] for updates. As a workaround, ensure scanning is performed at safe times and consider additional network defenses.