Bitdefender SafePay launch Remote Code Execution Vulnerability

Publication date: January 29th, 2019

CVSS scrore:
8.8 -
Affected vendors:
Affected products:
Bitdefender SafePay
Vulnerability details:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of TIScript. When processing the launch method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability execute code in the context of the current process.

Additional details:
This issue was resolved in version
Disclosure timeline:
2018-09-19 - Vulnerability reported to vendor 2019-01-29 - Coordinated public release of advisory
Mat Powell of Trend Micro Zero Day Initiative