Medium severity · published Mar 2, 2017
CVE-2016-9892
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from…
5.9
CVSS
1.7%
EPSS
No
On KEV
Description
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Endpoint Antivirus · Eset
6.3.70.1 · source: NVD
ES
Endpoint Security · Eset
6.3.70.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9892
Exploit
http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html
Exploit
http://seclists.org/fulldisclosure/2017/Feb/68
Vendor Advisory
http://support.eset.com/ca6333/
Third Party Advisory
http://www.securityfocus.com/bid/96462
More from Endpoint Antivirus
8.6
CVE-2023-5594
Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted
7.8
CVE-2024-0353
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission
7.8
CVE-2023-3160
The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or move files without having proper permissions
7.8
CVE-2023-2847
During internal security analysis, a local privilege escalation vulnerability has been identified
7.8
CVE-2021-37851
Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher…