BitDefender update patches Safepay error handling bug

• BitDefender’s Safepay had a bug that malicious actors could have exploited in RCE attacks.
• BitDefender issued an update that patches the browser vulnerability.
• Feel free to visit the BitDefender page to learn more about downloading and securing your Windows 10 PC with the antivirus tool.
• For tips and guides to optimizing your PC security, check out the Security & Privacy page.

The BitDefender is one of the most popular antivirus solutions for resolving different types of cyber threats, including data theft, ransomware, and distributed denial of service (DDoS) attacks.

But it’s got its own inherent security flaws as cybersecurity researcher Wladimir Palant revealed recently.

Notably, Bitdefender’s Safepay had a bug that malicious actors could have exploited in remote code execution (RCE) attacks.

BitDefender fixes Safepay bug

Palant brought the Safepay issue to the attention of BitDefender, which swiftly released an update with a security fix.

Safepay is a browser security component that should protect your online transactions, including banking and e-shopping. Its objective is to put your browser activity in a sealed environment, making the theft of your personal information difficult.

It is ironic, then, that the same antivirus component meant to protect your browser could have been breached by cybercriminals.

BitDefender has since released an advisory on the Safepay bug it patched:

Improper Input Validation vulnerability in the Safepay browser component of BitDefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects BitDefender Total Security 2020 versions prior to 24.0.20.116.

The HTTPS error handling issue in Safepay

The CVE-2020-8102 flaw in Safepay has something to do with the way BitDefender handles HTTP connections.

According to Palant, the antivirus tool handles HTTP error certificates instead of leaving that task to the browser. So, when the solution encounters a suspicious security certificate, it offers the user the option of exiting to safety or proceeding to open the web page in question.

But the URL in the browser’s address bar remains the same, which appears to be the root cause of the RCE vulnerability.

For example, a hacker could load a malicious page in the Safepay by first presenting a valid certificate on initial request before changing to an invalid one from the same server. The vulnerable browser won’t stop the suspicious page behavior.

Thankfully, Palant’s is only a proof of concept (PoC), which is no evidence that some bad actors actually tried to exploit the RCE bug in Safepay.

As always, you’re welcome to leave any suggestions or questions in the comments section below.

and

If you are looking for a cheap and genuine microsoft product key, warranty for 1 year.
It will be available at the link: https://officerambo.com/shop/
Microsoft Windows Embedded 8.1 Industry Pro : https://officerambo.com/product/windows-embedded-8-1/
Key Windows 7 Professional / Home Base / Home Premium (2 USER) : https://officerambo.com/product/key-windows-7/
Microsoft Windows 8.1 PRO (2 PC) : https://officerambo.com/product/microsoft-windows-8-1-pro/
Windows Server 2012 R2 : https://officerambo.com/product/windows-server-2012-r2/
Visual Studio Enterprise 2019 : https://officerambo.com/product/visual-studio-enterprise-2019/
Windows Server Standard / Datacenter / Essentials : https://officerambo.com/product/windows-server-all-version-standard-datacenter-essentials/
Microsoft Office Professional Plus for Windows : https://officerambo.com/product/microsoft-office-professional-plus-for-windows/
Microsoft Office Home and Student for Windows : https://officerambo.com/product/microsoft-office-home-and-student/
Key Microsoft Access 2016 : https://officerambo.com/product/key-microsoft-access-2016/
Microsoft Visio Professional : https://officerambo.com/product/microsoft-visio-professional/
Microsoft Project Professional : https://officerambo.com/product/microsoft-project-professional/
Account Microsoft Office 365 Profestional Plus 2020 Update For 5 Devices : https://officerambo.com/product/account-microsoft-office-365/
Key Microsoft Windows 10 Profestional / Profestional N : https://officerambo.com/product/key-microsoft-windows-10/
Key Microsoft Windows XP Pro : https://officerambo.com/product/key-microsoft-windows-xp-pro/
Microsoft Office Home and Business for Mac : https://officerambo.com/product/microsoft-office-home-and-business-for-mac/