PT-2018-8988 · Ce Infosys+2 · Compusec+5

Yuji Tounai · Published 2018-09-07 · Updated 2018-11-19 · CVE-2018-0649

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ESET Smart Security Premium (affected versions not specified) ESET Internet Security (affected versions not specified) ESET Smart Security (affected versions not specified) ESET NOD32 Antivirus (affected versions not specified) DESlock+ Pro (affected versions not specified) CompuSec (affected versions not specified, except packaged ones)

Description The issue is related to an untrusted search path vulnerability in the installers of multiple software programs. This vulnerability allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Recommendations For ESET Smart Security Premium, update to a version that includes a fix for this issue. For ESET Internet Security, update to a version that includes a fix for this issue. For ESET Smart Security, update to a version that includes a fix for this issue. For ESET NOD32 Antivirus, update to a version that includes a fix for this issue. For DESlock+ Pro, update to a version that includes a fix for this issue. For CompuSec, update to a version that includes a fix for this issue, excluding packaged versions.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2018-0649

Affected Products

Compusec

Deslock+ Pro

Eset Internet Security

Eset Nod32 Antivirus

Eset Smart Security

Eset Smart Security Premium

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-0649 · Security Note
• https://eset-support.canon-its.jp/faq/show/10720?site_domain=default · Vendor Advisory
• http://jvn.jp/en/jp/JVN41452671/index.html · Note