The attack does not need to be tailored to a specific machine, like other Mac malware packages require. A patch rectifying the problem was supplied to the researchers in early February with a release on Feb. The flaw was discovered by Google, and reported to ESET in early November 2016. The esets_daemon service parses the response as an XML document, thereby allowing the attacker to supply malformed content."
"The esets_daemon service does not validate the web server's certificate, so a man-in-the-middle can intercept the request and respond using a self-signed HTTPS certificate. "When ESET Endpoint Antivirus tries to activate its license, esets_daemon sends a request to ," reports Google Security Team's Jason Geffner and Jan Bee. A follow-up transmission can contain a maliciously crafted XML package, allowing for root-level code execution. In this case, a forged HTTPS certificate can be sent, allowing the attacker to control the connection.
Assailants using a man-in-the-middle targeted attack can intercept licensing credential data transfers, allowing for a machine masquerading as the licensing server to pass bogus data. The outdated XML library included in a recent update to ESET Endpoint Antivirus 6 is subject to a buffer overflow bug, according to Google researchers.
0 kommentar(er)
