Google researchers discovered a critical flaw in ESET Endpoint Antivirus for macOS that could have been exploited by an unauthenticated attacker to remotely execute arbitrary code with root privileges. ESET has released an update that addresses the vulnerability.
The security hole, tracked as CVE-2016-9892, was identified in early November 2016 by Jason Geffner and Jan Bee of the Google Security Team. The flaw affects ESET Endpoint Antivirus 6 for macOS and it has been patched on February 21 with the release of version 6.4.168.0.
The problem, according to the experts, was related to a service named esets_daemon that runs as root. The service is statically linked with an old version of the POCO XML parsing library. The vulnerable version of POCO, 1.4.6p1, released in 2013, is based on a version of the Expat XML parser library affected by CVE-2016-0718, a flaw that allows an attacker to execute arbitrary code via specially crafted XML content.
A man-in-the-middle (MitM) attacker could have exploited the vulnerability when the esets_daemon service sent a request to https://edf.eset.com/edf during activation of the ESET Endpoint Antivirus product. An attack was possible due to the fact that the antivirus failed to validate the web server’s certificate.
An attacker could have intercepted the request to deliver a malicious XML document using a self-signed HTTPS certificate. CVE-2016-0718 would get triggered and the malicious code executed with root privileges when esets_daemon parsed the XML content.
The proof-of-concept (PoC) code released by the Google researchers only shows how the ESET antivirus application can be caused to crash.
ESET addressed the vulnerability by upgrading the POCO parsing library and by configuring the product to verify SSL certificates.
This was not the first time Google researchers found vulnerabilities in ESET products. In 2015, Tavis Ormandy discovered a critical flaw in the security firm’s Windows and OS X products that could have been exploited to take complete control of a device.
Related: Buggy ESET Update Blocks Many Websites
Related: HTTPS Security Weakened by AV Products, Middleboxes