CVE-2023-42525 - Vulnerability Details - OpenCVE

Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Apple	Macos
Linux	Linux Kernel
Microsoft	Windows
Withsecure	Atlant Client Security Elements Endpoint Protection Email And Server Security Linux Protection Linux Security 64 Server Security

Configuration 1 [-]

AND

OR	cpe:2.3:a:withsecure:client_security:15:::::::*
	cpe:2.3:a:withsecure:elements_endpoint_protection::::::::
	cpe:2.3:a:withsecure:email_and_server_security:15:::::::*
	cpe:2.3:a:withsecure:server_security:15:::::::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:a:withsecure:client_security:15:::::::*
	cpe:2.3:a:withsecure:elements_endpoint_protection::::::::

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:a:withsecure:linux_protection:12.0:::::::*
	cpe:2.3:a:withsecure:linux_security_64:12.0:::::::*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 4 [-]

cpe:2.3:a:withsecure:atlant:1.0.35-1:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.withsecure.com/en/support/security-advisories

History

Wed, 25 Sep 2024 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-09-18T00:00:00

Updated: 2024-09-25T15:49:52.972Z

Reserved: 2023-09-11T00:00:00

Link: CVE-2023-42525

Vulnrichment

Updated: 2024-08-02T19:23:39.373Z

NVD

Status : Modified

Published: 2023-09-18T07:15:38.193

Modified: 2024-11-21T08:22:42.807

Link: CVE-2023-42525

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:withsecure:client_security:15:*:*:*:*:*:*:*", "matchCriteriaId": "1755AB17-E9C9-4616-98B4-843B75668CA4", "vulnerable": true}, {"criteria": "cpe:2.3:a:withsecure:elements_endpoint_protection:*:*:*:*:*:*:*:*", "matchCriteriaId": "B92950AC-F16B-4935-93D8-39E6DC6B0B5A", "versionStartIncluding": "17", "vulnerable": true}, {"criteria": "cpe:2.3:a:withsecure:email_and_server_security:15:*:*:*:*:*:*:*", "matchCriteriaId": "2E1B31DD-3C88-4826-8E24-588FED197C5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:withsecure:server_security:15:*:*:*:*:*:*:*", "matchCriteriaId": "015D02AD-F46F-46DF-9CD8-E0DB78CE17DD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:withsecure:client_security:15:*:*:*:*:*:*:*", "matchCriteriaId": "1755AB17-E9C9-4616-98B4-843B75668CA4", "vulnerable": true}, {"criteria": "cpe:2.3:a:withsecure:elements_endpoint_protection:*:*:*:*:*:*:*:*", "matchCriteriaId": "B92950AC-F16B-4935-93D8-39E6DC6B0B5A", "versionStartIncluding": "17", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:withsecure:linux_protection:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "FCA1C33E-551B-4CBF-A0C0-663A32611D29", "vulnerable": true}, {"criteria": "cpe:2.3:a:withsecure:linux_security_64:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "ACBC6F42-8F62-4599-83F3-9E9147D46129", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:withsecure:atlant:1.0.35-1:*:*:*:*:*:*:*", "matchCriteriaId": "3BA1712F-D879-44CA-BCAD-49D6533D1E8E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1."}, {"lang": "es", "value": "Ciertos productos WithSecure permiten un bucle infinito en un motor de escaneo a trav\u00e9s de tipos de archivos no especificados. Esto afecta a WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email y Server Security 15, WithSecure Elements Endpoint Protection 17 y versiones posteriores, WithSecure Client Security para Mac 15, WithSecure Elements Endpoint Protection para Mac 17 y versiones posteriores, Linux Security 64 12.0, Linux Protection 12.0 y WithSecure Atlant (anteriormente F-Secure Atlant) 1.0.35-1. "}], "id": "CVE-2023-42525", "lastModified": "2024-11-21T08:22:42.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-18T07:15:38.193", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.withsecure.com/en/support/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.withsecure.com/en/support/security-advisories"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}