CVE-2022-28884

A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.withsecure.com/en/expertise/people	Vendor Advisory
https://www.withsecure.com/en/support/security-advisories	Vendor Advisory
https://www.withsecure.com/en/expertise/people	Vendor Advisory
https://www.withsecure.com/en/support/security-advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:withsecure:business_suite:-::::::x86:
	cpe:2.3:a:withsecure:elements_endpoint_protection:::::::x86:*

Configuration 2 (hide)

OR	cpe:2.3:a:f-secure:internet_gatekeeper:-:::::-::
	cpe:2.3:a:f-secure:linux_security:-::::::x86:

History

21 Nov 2024, 06:58

Type	Values Removed	Values Added
References	~~() https://www.withsecure.com/en/expertise/people - Vendor Advisory~~	() https://www.withsecure.com/en/expertise/people - Vendor Advisory
References	~~() https://www.withsecure.com/en/support/security-advisories - Vendor Advisory~~	() https://www.withsecure.com/en/support/security-advisories - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 4.3

Information

Published : 2022-09-06 18:15

Updated : 2024-11-21 06:58

NVD link : CVE-2022-28884

Mitre link : CVE-2022-28884

CVE.ORG link : CVE-2022-28884

JSON object : View

Products Affected

f-secure

internet_gatekeeper
linux_security

withsecure

business_suite
elements_endpoint_protection

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2022-28884", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-notifications-us@f-secure.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-09-06T18:15:12.907", "references": [{"url": "https://www.withsecure.com/en/expertise/people", "tags": ["Vendor Advisory"], "source": "cve-notifications-us@f-secure.com"}, {"url": "https://www.withsecure.com/en/support/security-advisories", "tags": ["Vendor Advisory"], "source": "cve-notifications-us@f-secure.com"}, {"url": "https://www.withsecure.com/en/expertise/people", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.withsecure.com/en/support/security-advisories", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de denegaci\u00f3n de servicio en los productos F-Secure y WithSecure por la que el archivo aerdl.dll puede entrar en un bucle infinito cuando desempaqueta archivos PE. Es posible que esto pueda bloquear el motor de escaneo."}], "lastModified": "2024-11-21T06:58:07.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:withsecure:business_suite:-:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "2F2293B1-0239-4B61-86ED-92A47D8954D6"}, {"criteria": "cpe:2.3:a:withsecure:elements_endpoint_protection:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "ED47159B-1F79-4C35-A6D9-4424C6B27A8D"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f-secure:internet_gatekeeper:-:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "716021F0-35B9-4567-838A-DAEC65A6601F"}, {"criteria": "cpe:2.3:a:f-secure:linux_security:-:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "26113C91-7FD5-4C3B-84F7-6A986CA26461"}], "operator": "OR"}]}], "sourceIdentifier": "cve-notifications-us@f-secure.com"}