New Update DLL Search Order Hijacking Vulnerability in ESET products for Windows fixed

[Gandalf_The_Grey]

Summary

A report of a DLL search order hijacking vulnerability was submitted to ESET by Andrei Gunkin from Kaspersky. The vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. ESET mitigated this by preparing fixed versions of its security products.

Details

On systems with an affected ESET product installed, an attacker could plant a malicious dynamic-link library to a specific folder and execute its content by running ESET Command Line Scanner, which would load the planted library instead of the intended system library.

This technique did not elevate the privileges, though—the attacker would have already needed to have administrator privileges to perform this attack.

The reserved CVE ID for this vulnerability is CVE-2024-11859, the CVSS v4.0 score is 6.8.

Solution

ESET prepared fixed builds of its consumer, business and server security products for the Windows operating system and recommends upgrading to these or scheduling the upgrades in the near future. The fixed builds are available in the Download section of www.eset.com or via ESET Repository.

• ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate 18.1.10.0 and later
• ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows 12.0.2045.0, 11.1.2059.0 and later from the respective version family
• ESET Small Business Security and ESET Safe Server 18.1.10.0 and later
• ESET Server Security for Windows Server (formerly File Security for Microsoft Windows Server) 11.1.12009.0 and later
• ESET Mail Security for Microsoft Exchange Server 11.1.10011.0, 11.0.10010.0, 10.1.10017.0 and later from the respective version family
• ESET Security for Microsoft SharePoint Server 11.1.15003.0, 11.0.15007.0, 10.0.15008.0 and later from the respective version family

[CA8810] DLL Search Order Hijacking Vulnerability in ESET products for Windows fixed

support.eset.com

 

[SeriousHoax]

I like this from the link above:

Acknowledgment​

ESET values the principles of coordinated disclosure within the security industry and would like to express our thanks to Andrey Gunkin from Kaspersky.

 

[IceMan7]

That's nice. Especially from the competition from a country on censorship

 

[anirbandutta01]

[CA8810] DLL Search Order Hijacking Vulnerability in ESET products for Windows fixed

support.eset.com

Great work, Kaspersky! Glad to know that they not only analyze their applications & fix these by finding loophole in their applications but also analyze & finding loopholes in others Antivirus vendors applications & inform them.