CVE-2021-3579
📋 TL;DR
This vulnerability allows a local attacker to escalate privileges to SYSTEM level on Windows systems by exploiting incorrect default permissions in Bitdefender components. It affects Bitdefender Endpoint Security Tools for Windows and Total Security versions prior to 7.2.1.65, enabling unauthorized access to sensitive system resources.
💻 Affected Systems
- Bitdefender Endpoint Security Tools for Windows
- Bitdefender Total Security
📦 What is this software?
Total Security by Bitdefender
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full SYSTEM privileges, allowing complete control over the system, including installing malware, stealing data, or disabling security tools.
Likely Case
Local privilege escalation leading to persistence, credential theft, or lateral movement within a network.
If Mitigated
Limited impact if patched or if strong access controls prevent local attacker access.
🎯 Exploit Status
Exploitation requires local access but is straightforward due to misconfigured permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.2.1.65 or later
Restart Required: Yes
Instructions:
1. Open Bitdefender interface. 2. Check for updates in the settings. 3. Install update to version 7.2.1.65 or higher. 4. Restart the system as prompted.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local user access to systems to reduce attack surface.
🧯 If You Can't Patch
- Monitor for suspicious privilege escalation attempts using security logs.
- Implement strict user access controls and least privilege principles.
🔍 How to Verify
Check if Vulnerable:
Check Bitdefender version in the application interface or via command: wmic product where name like 'Bitdefender%' get versionCheck Version:
wmic product where name like 'Bitdefender%' get versionVerify Fix Applied:
Confirm version is 7.2.1.65 or later using the same command or interface.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation by bdservicehost.exe or Vulnerability.Scan.exe
- Privilege escalation events in Windows Security logs
Network Indicators:
- None, as this is a local exploit
SIEM Query:
EventID=4688 AND (ProcessName='bdservicehost.exe' OR ProcessName='Vulnerability.Scan.exe') AND NewProcessName contains 'SYSTEM'🔗 References
- https://www.bitdefender.com/support/security-advisories/incorrect-default-permissions-vulnerability-in-bdservicehost-exe-and-vulnerability-scan-exe-va-9848/
- https://www.zerodayinitiative.com/advisories/ZDI-21-1277/
- https://www.bitdefender.com/support/security-advisories/incorrect-default-permissions-vulnerability-in-bdservicehost-exe-and-vulnerability-scan-exe-va-9848/
- https://www.zerodayinitiative.com/advisories/ZDI-21-1277/
