Medium severity · published Mar 2, 2017
CVE-2016-9892
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from…
5.9
CVSS
1.7%
EPSS
No
On KEV
Description
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Endpoint Antivirus · Eset
6.3.70.1 · source: NVD
ES
Endpoint Security · Eset
6.3.70.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9892
Exploit
http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html
Exploit
http://seclists.org/fulldisclosure/2017/Feb/68
Vendor Advisory
http://support.eset.com/ca6333/
Third Party Advisory
http://www.securityfocus.com/bid/96462
More from Endpoint Antivirus
8.6
CVE-2023-5594
Improper following of a certificate's chain of trust in ESET security products
7.8
CVE-2024-0353
Local privilege escalation in Windows products
7.8
CVE-2023-3160
Local privilege escalation in security products for Windows
7.8
CVE-2023-2847
During internal security analysis, a local privilege escalation vulnerability has been identified
7.8
CVE-2021-37851
Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher…