JVN#95898697
Multiple ESET products for macOS vulnerable to improper server certificate verification
Overview
Multiple ESET products for macOS are vulnerable to improper server certificate verification.
Products Affected
- ESET Cyber Security 6.1.x to 6.3.70.1
- ESET Cyber Security Pro 6.1.x to 6.3.70.1
- ESET Endpoint Antivirus for macOS 6.0.x to 6.3.85.1
- ESET Endpoint Security for macOS 6.0.x to 6.3.85.1
Description
Multiple ESET products for macOS are vulnerable to improper server certificate verification (CWE-295).
Impact
A man-in-the-middle attack may allow an attacker to alter the data received by the affected products.
Solution
Update the software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions that address the vulnerability.
- ESET Cyber Security 6.4.128.0 (released on February 13, 2017)
- ESET Cyber Security Pro 6.4.128.0 (released on February 13, 2017)
- ESET Endpoint Antivirus for macOS 6.4.168.0 (released on February 14, 2017)
- ESET Endpoint Security for macOS 6.4.168.0 (released on February 14, 2017)
Vendor Status
References
JPCERT/CC Addendum
This JVN publication was delayed to 2022/2/7 after the developer's fix was published.
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
KOBAYASHI Yasuyuki reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-9892 |
| JVN iPedia |
JVNDB-2016-008013 |