CVE-2021-33602

Denial-of-Service (DoS) Vulnerability

Published Oct 6, 2021 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

F-Secure

F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Atlant & F-Secure Cloud Protection for Salesforce

affected

Version	Status	Constraints
`All Version`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:f-secure:atlant::::::::
	cpe:2.3:a:f-secure:cloud_protection::::::salesforce::*
	cpe:2.3:a:f-secure:internet_gatekeeper::::::::
	cpe:2.3:a:f-secure:linux_security::::::::

No data.

No data available yet.

Remediation

Vendor Solution

FIX No User action is required. The required fix has been published through the automatic update channel with Capricorn update 2021-09-29_03

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2021-20286	A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.