CVE-2021-4199: 
Bitdefender Internet Security vulnerability analysis and mitigation

CVE-2021-4199 is an Incorrect Permission Assignment for Critical Resource vulnerability discovered in Bitdefender's crash handling component BDReinit.exe. The vulnerability affects multiple Bitdefender products including Total Security, Internet Security, Antivirus Plus, and Endpoint Security Tools for Windows. The issue was reported on September 8, 2021, and publicly disclosed on March 9, 2022 (ZDI Advisory, Bitdefender Advisory).

The vulnerability received a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The specific flaw exists within the Bitdefender Auxiliary Service, where an attacker can create a symbolic link to abuse the service for file overwriting. The vulnerability affects Bitdefender Total Security, Internet Security, and Antivirus Plus versions prior to 26.0.3.29, as well as Endpoint Security Tools for Windows versions prior to 7.4.3.146 (Bitdefender Advisory).

The vulnerability allows attackers to escalate privileges to SYSTEM level, potentially enabling the execution of arbitrary code with elevated permissions. This could give attackers complete control over the affected system (ZDI Advisory).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. The exploitation involves creating a symbolic link to abuse the Bitdefender Auxiliary Service (ZDI Advisory).

Bitdefender has released automatic updates to address this vulnerability. The fixed versions are: Bitdefender Total Security version 26.0.3.29, Internet Security version 26.0.3.29, Antivirus Plus version 26.0.3.29, and Endpoint Security Tools for Windows version 7.4.3.146 (Bitdefender Advisory).