Denial-of-Service (DoS) Vulnerability

Vulnerability

A Denial-of-Service vulnerability exists in the aerdl.dll unpacker component of WithSecure (formerly F-Secure) Atlant and certain other endpoint protection products. The flaw causes a crash in the unpacker function when scanning a specially crafted file, leading to a scan engine crash. Affected products include all F-Secure endpoint protection products for Windows and potentially other WithSecure products that incorporate the Atlant engine [1] [2].

Exploitation

An attacker can trigger the vulnerability remotely by delivering a malicious file (e.g., via email, web download, or network share) that is subsequently scanned by the affected product. No authentication or special privileges are required from the attacker; the exploit is executed when the vulnerable engine attempts to unpack the malformed file [1] [2].

Impact

Successful exploitation results in a crash of the scanning engine, causing a Denial-of-Service condition. The system may fail to scan further files until the engine is restarted. There is no indication of information disclosure, privilege escalation, or code execution; the impact is limited to availability [1] [2].

Mitigation

F-Secure/WithSecure addressed this vulnerability in an update released on or before August 10, 2022. Users should ensure their product is updated to the latest version. No workarounds have been published; however, keeping the product up to date and limiting exposure to untrusted file sources can reduce risk [1] [2].