CVE-2016-9892

low-risk
Published 2017-03-02

The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.

Do I need to act?

-
0.18% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Endpoint Antivirus
Endpoint Security

Affected Vendors

Eset

References (8)

Exploit http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Cod...
Exploit http://seclists.org/fulldisclosure/2017/Feb/68
Vendor Advisory http://support.eset.com/ca6333/
Third Party Advisory http://www.securityfocus.com/bid/96462
Exploit http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Cod...
Exploit http://seclists.org/fulldisclosure/2017/Feb/68
Vendor Advisory http://support.eset.com/ca6333/
Third Party Advisory http://www.securityfocus.com/bid/96462
26
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low