CVE-2022-28880 - OpenCVE

A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an attacker.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Macos
F-secure	Atlant Cloud Protection For Salesforce Elements Collaboration Protection Elements Endpoint Detection And Response Elements Endpoint Protection Internet Gatekeeper Linux Security Linux Security 64
Microsoft	Windows

Configuration 1 [-]

AND

OR	cpe:2.3:a:f-secure:elements_endpoint_detection_and_response::::::::
	cpe:2.3:a:f-secure:elements_endpoint_protection::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:f-secure:atlant::::::::
	cpe:2.3:a:f-secure:cloud_protection_for_salesforce::::::::
	cpe:2.3:a:f-secure:elements_collaboration_protection::::::::
	cpe:2.3:a:f-secure:internet_gatekeeper::::::::
	cpe:2.3:a:f-secure:linux_security:::::::x86:*
	cpe:2.3:a:f-secure:linux_security_64::::::::

No data.

References

Link	Providers
https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame
https://www.withsecure.com/en/expertise/people

History

No history.

MITRE

Status: PUBLISHED

Assigner: F-SecureUS

Published: 2022-08-05T16:46:48

Updated: 2024-08-03T06:03:53.199Z

Reserved: 2022-04-08T00:00:00

Link: CVE-2022-28880

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-08-05T17:15:08.447

Modified: 2022-08-15T23:06:54.060

Link: CVE-2022-28880

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "All F-Secure and WithSecure Endpoint Protection products for Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-Secure Internet Gatekeeper WithSecure Cloud Protection for Salesforce WithSecure Collaboration Protection", "vendor": "F-Secure", "versions": [{"status": "affected", "version": "All Version "}]}], "descriptions": [{"lang": "en", "value": "A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an attacker."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Denial-of-Service (DoS) Vulnerability ", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-08-05T16:46:48", "orgId": "126858f1-1b65-4b74-81ca-7034f7f7723f", "shortName": "F-SecureUS"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.withsecure.com/en/expertise/people"}, {"tags": ["x_refsource_MISC"], "url": "https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame"}], "solutions": [{"lang": "en", "value": "FIX No User action is required. The required fix has been published through automatic update channel with Capricorn database on 2022-07-29_13"}], "source": {"discovery": "EXTERNAL"}, "title": "Denial-of-Service (DoS) Vulnerability ", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-notifications-us@f-secure.com", "ID": "CVE-2022-28880", "STATE": "PUBLIC", "TITLE": "Denial-of-Service (DoS) Vulnerability "}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "All F-Secure and WithSecure Endpoint Protection products for Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-Secure Internet Gatekeeper WithSecure Cloud Protection for Salesforce WithSecure Collaboration Protection", "version": {"version_data": [{"version_affected": "=", "version_value": "All Version "}]}}]}, "vendor_name": "F-Secure"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an attacker."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Denial-of-Service (DoS) Vulnerability "}]}]}, "references": {"reference_data": [{"name": "https://www.withsecure.com/en/expertise/people", "refsource": "MISC", "url": "https://www.withsecure.com/en/expertise/people"}, {"name": "https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame", "refsource": "MISC", "url": "https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame"}]}, "solution": [{"lang": "en", "value": "FIX No User action is required. The required fix has been published through automatic update channel with Capricorn database on 2022-07-29_13"}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:03:53.199Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.withsecure.com/en/expertise/people"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame"}]}]}, "cveMetadata": {"assignerOrgId": "126858f1-1b65-4b74-81ca-7034f7f7723f", "assignerShortName": "F-SecureUS", "cveId": "CVE-2022-28880", "datePublished": "2022-08-05T16:46:48", "dateReserved": "2022-04-08T00:00:00", "dateUpdated": "2024-08-03T06:03:53.199Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f-secure:elements_endpoint_detection_and_response:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F97045C-E576-49D3-9630-072E26F7D64F", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-secure:elements_endpoint_protection:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DFC1F94-8A8B-42E2-887B-EE8FB3C9130D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f-secure:atlant:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C97DC3C-1B63-4B57-8C62-ACD77D0A3E71", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-secure:cloud_protection_for_salesforce:*:*:*:*:*:*:*:*", "matchCriteriaId": "31ECCE87-B67E-4CA7-91E6-8E71CEA6DA21", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-secure:elements_collaboration_protection:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B107FE0-0F9E-4021-917F-1224F2619339", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-secure:internet_gatekeeper:*:*:*:*:*:*:*:*", "matchCriteriaId": "88F6E1F2-02DA-48EE-B127-4933CCC80C5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-secure:linux_security:*:*:*:*:*:*:x86:*", "matchCriteriaId": "F0152E70-F7A9-4785-8A43-78472F9A2C13", "vulnerable": true}, {"criteria": "cpe:2.3:a:f-secure:linux_security_64:*:*:*:*:*:*:*:*", "matchCriteriaId": "360DBC2B-2B93-461E-90C6-60C55FBD87B8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an attacker."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de denegaci\u00f3n de servicio en F-Secure Atlant y en algunos productos WithSecure durante el escaneo de archivos fuzzed PE32-bit que puede bloquear el motor de escaneo. La explotaci\u00f3n puede ser desencadenada remotamente por un atacante"}], "id": "CVE-2022-28880", "lastModified": "2022-08-15T23:06:54.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "cve-notifications-us@f-secure.com", "type": "Secondary"}]}, "published": "2022-08-05T17:15:08.447", "references": [{"source": "cve-notifications-us@f-secure.com", "tags": ["Not Applicable", "Vendor Advisory"], "url": "https://www.f-secure.com/en/home/support/vulnerability-reward-program/hall-of-fame"}, {"source": "cve-notifications-us@f-secure.com", "tags": ["Not Applicable", "Vendor Advisory"], "url": "https://www.withsecure.com/en/expertise/people"}], "sourceIdentifier": "cve-notifications-us@f-secure.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}