Podatność w programach ESET

[ichito]

Co prawda ogłoszono oficjalnie, że podatność załatano, ale faktem jest że ją znaleziono i że była (jest?) groźna. Informację na swoich stronach opublikował zespół analityków Google pod nazwą Project Zero, a podatność pozwalała na przejęcie kontroli nad systemem użytkownika

 Many antivirus products include emulation capabilities that are intended to allow unpackers to run for a few cycles before signatures are applied. ESET NOD32 uses a minifilter or kext to intercept all disk I/O, which is analyzed and then emulated if executable code is detected.


Attackers can cause I/O via Web Browsers, Email, IM, file sharing, network storage, USB, or hundreds of other vectors. Whenever a message, file, image or other data is received, it’s likely some untrusted data passes through the disk. Because it’s so easy for attackers to trigger emulation of untrusted code, it’s critically important that the emulator is robust and isolated.


Unfortunately, analysis of ESET emulation reveals that is not the case and it can be trivially compromised. This report discusses the development of a remote root exploit for an ESET vulnerability and demonstrates how attackers could compromise ESET users. This is not a theoretical risk, recent evidence suggests a growing interest in anti-virus products from advanced attackers.

Any network connected computer running ESET can be completely compromised. A complete compromise would allow reading, modifying or deleting any files on the system regardless of access rights; installing any program or rootkit; accessing hardware such as camera, microphones or scanners; logging all system activity such as keystrokes or network traffic; and so on.

 Zagrożone są poniższe produkty...użytkownicy tych produktów...jeśli pracują na domyślnych ustawieniach programu
- ESET Smart Security (Windows)
- ESET NOD32 Antivirus (Windows)
- ESET Cyber Security Pro (OS X)
- ESET NOD32 For Linux Desktop
- ESET Endpoint Security (Windows i OS X)
- ESET NOD32 Business Edition

Źródło

[Aby zobaczyć linki, zarejestruj się tutaj]

Informacja ESET o łatce

[Aby zobaczyć linki, zarejestruj się tutaj]