CVE-2023-42520

Vulnerability

A denial-of-service vulnerability exists in the scanning engines of certain WithSecure products, allowing a remote crash by unpacking crafted data files. Affected products include WithSecure Client Security 15, Server Security 15, Email and Server Security 15, Elements Endpoint Protection 17 and later, Client Security for Mac 15, Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0, Linux Protection 12.0, and WithSecure Atlant 1.0.35-1 [1].

Exploitation

An attacker can remotely trigger a crash by sending a specially crafted data file to be scanned by the affected product. No user interaction beyond normal scanning operations is required; the vulnerability is triggered during the unpacking process [1].

Impact

Successful exploitation results in a denial of service (DoS) due to the scanning engine crashing. This may disrupt security scanning functionality and could affect system availability if the engine is critical [1].

Mitigation

As of the publication date, no patch or fix has been disclosed in the available reference [1]. Users should monitor the vendor's security advisory page for updates. No workarounds are provided in the reference.