Vulnerability-Lookup

JVNDB-2021-000098

Vulnerability from jvndb - Published: 2021-10-29 05:58 - Updated:2021-10-29 05:58

Severity

5.5 (Medium) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

ESET Cyber Security and ESET Endpoint series vulnerable to denial-of-service (DoS)

Details

ESET Cyber Security and ESET Endpoint series are antivirus software. ESET Cyber Security and ESET Endpoint series for macOS contain a denial-of-service (DoS) vulnerability (CWE-404). Zhou Tingrui of Kaijo Junior & Senior High School reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN60553023/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37850
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-37850
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	ESET	ESET Cyber Security
	ESET	ESET Endpoint Antivirus
	ESET	ESET Endpoint Security

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000098.html",
  "dc:date": "2021-10-29T14:58+09:00",
  "dcterms:issued": "2021-10-29T14:58+09:00",
  "dcterms:modified": "2021-10-29T14:58+09:00",
  "description": "ESET Cyber Security and ESET Endpoint series are antivirus software. ESET Cyber Security and ESET Endpoint series for macOS contain a denial-of-service (DoS) vulnerability (CWE-404).\r\n\r\nZhou Tingrui of Kaijo Junior \u0026 Senior High School reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000098.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:eset:cyber_security",
      "@product": "ESET Cyber Security",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:endpoint_antivirus",
      "@product": "ESET Endpoint Antivirus",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:endpoint_security",
      "@product": "ESET Endpoint Security",
      "@vendor": "ESET",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "1.7",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
      "@version": "2.0"
    },
    {
      "@score": "5.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000098",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN60553023/index.html",
      "@id": "JVN#60553023",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37850",
      "@id": "CVE-2021-37850",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-37850",
      "@id": "CVE-2021-37850",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "ESET Cyber Security and ESET Endpoint series vulnerable to denial-of-service (DoS)"
}

CVE-2021-37850 (GCVE-0-2021-37850)

Vulnerability from cvelistv5 – Published: 2021-11-08 13:35 – Updated: 2024-08-04 01:30

Title

Denial of service in ESET for Mac products

Summary

ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Denial Of Service

Assigner

ESET ENISA root Scorecard

References

1 reference

URL	Tags
https://support.eset.com/en/ca8151	x_refsource_MISC

Impacted products

4 products

Vendor	Product	Version
ESET, spol. s r.o.	ESET Cyber Security	Affected: unspecified , ≤ 6.10.700 (custom)
ESET, spol. s r.o.	ESET Cyber Security Pro	Affected: unspecified , < 6.10.700 (custom)
ESET, spol. s r.o.	ESET Endpoint Antivirus for macOS	Affected: unspecified , < 6.10.910.0 (custom)
ESET, spol. s r.o.	ESET Endpoint Security for macOS	Affected: unspecified , < 6.10.910.0 (custom)

Credits

ESET values the principles of responsible disclosure within the security industry and would like to express our thanks to Teiei Shu (廷叡周) who reported this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:30:09.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.eset.com/en/ca8151"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ESET Cyber Security",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "lessThanOrEqual": "6.10.700",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Cyber Security Pro",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "lessThan": "6.10.700",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Endpoint Antivirus for macOS",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "lessThan": "6.10.910.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ESET Endpoint Security for macOS",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "lessThan": "6.10.910.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ESET values the principles of responsible disclosure within the security industry and would like to express our thanks to Teiei Shu (\u5ef7\u53e1 \u5468) who reported this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial Of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-08T13:35:49.000Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.eset.com/en/ca8151"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Denial of service in ESET for Mac products",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@eset.com",
          "ID": "CVE-2021-37850",
          "STATE": "PUBLIC",
          "TITLE": "Denial of service in ESET for Mac products"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ESET Cyber Security",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "6.10.700"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Cyber Security Pro",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.10.700"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Endpoint Antivirus for macOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.10.910.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESET Endpoint Security for macOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.10.910.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ESET, spol. s r.o."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "ESET values the principles of responsible disclosure within the security industry and would like to express our thanks to Teiei Shu (\u5ef7\u53e1 \u5468) who reported this issue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial Of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.eset.com/en/ca8151",
              "refsource": "MISC",
              "url": "https://support.eset.com/en/ca8151"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2021-37850",
    "datePublished": "2021-11-08T13:35:49.000Z",
    "dateReserved": "2021-08-02T00:00:00.000Z",
    "dateUpdated": "2024-08-04T01:30:09.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

JVNDB-2021-000098

CVE-2021-37850 (GCVE-0-2021-37850)

Tags

Sightings

Nomenclature

Related by attack behaviour