![]() ![]() The esets_daemon service does not validate the web server’s certificate, so a man-in-the-middle can intercept the request and respond using a self-signed HTTPS certificate. “When ESET Endpoint Antivirus tries to activate its license, esets_daemon sends a request to. “This version of POCO is based on Expat ( ) version 2.0.1 from, which has a publicly known XML parsing vulnerability (CVE-2016-0718) that allows for arbitrary code execution via malformed XML content,” the researchers explained. The latest in a long list of examples that prove this fact is the recently revealed remote code execution flaw affecting all but the latest version of ESET Endpoint Antivirus 6 for macOS.ĭiscovered and reported by Jason Geffner and Jan Bee of the Google Security Team, the vulnerability (CVE-2016-9892) is present because the esets_daemon service is statically linked with an outdated version of the POCO XML parser library. ![]() Like any other software, security software is sure to have some vulnerabilities that can be exploited by attackers.
0 Comments
Leave a Reply. |