ESET macOS DoS Vulnerability via Symlink (CVE-2024-6654)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Type: Denial-of-service vulnerability - Affected Products: ESET endpoint products for macOS - Affected Versions: ESET Cyber Security 7.0 - 7.4.1600.0 and ESET Endpoint Antivirus for macOS 7.0 - 7.5.50.0 2. Vulnerability Impact: - Description: In affected ESET products, a vulnerability exists that allows a user with low privileges to create a symlink in a specific location, thereby preventing the ESET security product from starting normally. - Exploitation: After installation of affected ESET products, if a user has low privileges, they can exploit this vulnerability by creating a symlink in a specific location, causing the ESET security product to fail to start properly. 3. Solution: - Remediation: ESET has fixed this vulnerability and released new patched versions. - Patched Versions: ESET Cyber Security 7.5.74.0 and ESET Endpoint Security for macOS 8.0.7200.0 - Recommendation: ESET recommends users upgrade to these patched versions or obtain the latest version via the automatic update feature. 4. Vulnerability Details: - CVE ID: CVE-2024-6654 - CVSS Score: 6.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) 5. Affected Platforms: - Operating Systems: macOS 11.0 (Big Sur) and macOS 12.0 (Monterey) 6. Feedback and Support: - Contact: Feedback and support can be obtained via the ESET Security forum or local ESET technical support. 7. Version History: - Version 1.1: September 27, 2024 — Edited article title. - Version 1.0: September 20, 2024 — Initial version of the article. This information provides a detailed overview of the vulnerability’s nature, scope of impact, remediation steps, and contact options, helping users understand and respond to the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

ESET macOS DoS Vulnerability via Symlink (CVE-2024-6654)