Local Privilege Escalation in ESET Product

Executive Summary

This is a local privilege escalation vulnerability in ESET's macOS security applications. It allows an unprivileged local user to write arbitrary files with controlled content as a privileged user by exploiting an XPC service running with root permissions. The attacker could place a malicious .plist file in the LaunchDaemon folder to enable root code execution after a system reboot.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ESET macOS security application is running an outdated version. Compare your installed version against the fixed versions listed in the advisory. No specific commands are provided in the context for detection.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full control of your macOS system by executing arbitrary code with root privileges. This could lead to complete system compromise, data theft, or installation of additional malware. The impact is high as it requires only local access and no authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected ESET products may face compliance violations, potential fines, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ESET Endpoint Security for macOS to version 9.1.3100.0 or later (9.1 family), 9.0.6400.0 or later (9.0 family), or 8.1.300.0 or later (8.1 family). For ESET Cyber Security, update to version 9.0.6300.0 or later. Download updates from www.eset.com or the ESET Repository.

Useful 0 Not Useful 0