FSC-2015-2: Path traversal vulnerability

During internal testing, F-Secure identified a path traversal vulnerability in the database update component.

Corporate products:

• F-Secure Client Security 10.0 - 11.60
• F-Secure Client Security Premium 11.0 - 11.60
• F-Secure Anti-Virus for Workstations 10.0 - 11.60
• F-Secure Server Security 10.00 - 11.01
• F-Secure Server Security Premium 11.00 - 11.01
• F-Secure Email and Server Security 10.00 - 11.01
• F-Secure Email and Server Security Premium 10.00 - 11.01
• F-Secure Policy Manager for Windows 10.10 - 11.30
• F-Secure Protection Service for Business (PSB) Workstation Security 10.00 - 10.10
• F-Secure Protection Service for Business (PSB) Server Security 10.00 - 11.00
• F-Secure Protection Service for Business (PSB) Email and Server Security 10.00 - 11.00
• F-Secure Linux Security 10.00 - 10.20
• F-Secure Internet Gatekeeper 4.11 - 5.20
• F-Secure Policy Manager for Linux 10.10 - 11.30
• F-Secure Internet Gatekeeper for Virtual Appliance 5.20
• F-Secure Scanning and Reputation Server 11.00

Consumer products:

• F-Secure Safe Anywhere PC 12.0 – 15.1
• F-Secure Safe Anywhere Mac
• F-Secure Internet Security 2013 - 2015
• F-Secure Anti-Virus 2013 - 2015
• Younited clients
• F-Secure Online Scanner 6.2
• F-Secure Ultralight Anti-Virus (beta)

• All supported platforms for the affected products

During internal testing in F-Secure, it was discovered that it is possible for a remote attacker to perform path traversal against the update channel through a Man-in-the-Middle (MITM) attack. The effect of this upon successful exploitation is that an attacker can replace any file on an affected system.

This advisory will be updated as additional information becomes available.

Note: Appropriate fixes have been applied to all F-Secure backend systems prior to the security advisory release.

Date Issued: 2015-03-12
Date Updated: 2016-11-11