Vulnerability-Lookup

WID-SEC-W-2023-3211

Vulnerability from csaf_certbund - Published: 2023-12-21 23:00 - Updated: 2023-12-21 23:00

Summary

ESET Produkte: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Eset NOD32 Antivirus ist eine Internet Security Lösung. ESET Endpoint Security ist eine mehrschichtige, plattformübergreifende Sicherheitslösung für Clientsysteme. ESET Server Security ist eine Sicherheitslösung für Dateiserver zum Schutz vor z.B. Malware.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ESET NOD32 Antivirus, ESET Endpoint Security und ESET Server Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - UNIX - Linux - Windows - Sonstiges

CVE-2023-5594

Es existiert eine Schwachstelle in mehreren ESET Produkten. Diese besteht in der Funktion zur Überprüfung des sicheren Datenverkehrs in der SSL/TLS-Protokoll-Scanfunktion. Ein mit dem MD5- oder SHA1-Algorithmus signiertes Zwischenzertifikat wird fälschlicherweise als vertrauenswürdig eingestuft, so dass der Browser auf einem System mit aktivierter ESET-Funktion zur Überprüfung des sicheren Datenverkehrs dazu veranlasst wird, einer mit einem solchen Zertifikat gesicherten Website zu vertrauen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsmaßnahmen zu umgehen.

Affected products

Known affected 3 products

Product	Identifier	Version
ESET Endpoint Security ESET	`cpe:/a:eset:endpoint_security:-`	—
ESET NOD32 Antivirus ESET	`cpe:/a:eset:nod32:-`	—
ESET Server Security ESET	`cpe:/a:eset:server_security:-`	—

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.eset.com/en/ca8562-eset-customer-…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Eset NOD32 Antivirus ist eine Internet Security L\u00f6sung.\r\nESET Endpoint Security ist eine mehrschichtige, plattform\u00fcbergreifende Sicherheitsl\u00f6sung f\u00fcr Clientsysteme.\r\nESET Server Security ist eine Sicherheitsl\u00f6sung f\u00fcr Dateiserver zum Schutz vor z.B. Malware.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ESET NOD32 Antivirus, ESET Endpoint Security und ESET Server Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-3211 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3211.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-3211 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3211"
      },
      {
        "category": "external",
        "summary": "ESET Customer Advisory vom 2023-12-21",
        "url": "https://support.eset.com/en/ca8562-eset-customer-advisory-improper-following-of-a-certificates-chain-of-trust-in-eset-security-products-fixed"
      }
    ],
    "source_lang": "en-US",
    "title": "ESET Produkte: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-12-21T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:03:08.527+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-3211",
      "initial_release_date": "2023-12-21T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-12-21T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "ESET Endpoint Security",
            "product": {
              "name": "ESET Endpoint Security",
              "product_id": "T029295",
              "product_identification_helper": {
                "cpe": "cpe:/a:eset:endpoint_security:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ESET NOD32 Antivirus",
            "product": {
              "name": "ESET NOD32 Antivirus",
              "product_id": "T029294",
              "product_identification_helper": {
                "cpe": "cpe:/a:eset:nod32:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ESET Server Security",
            "product": {
              "name": "ESET Server Security",
              "product_id": "T029293",
              "product_identification_helper": {
                "cpe": "cpe:/a:eset:server_security:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "ESET"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-5594",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in mehreren ESET Produkten. Diese besteht in der Funktion zur \u00dcberpr\u00fcfung des sicheren Datenverkehrs in der SSL/TLS-Protokoll-Scanfunktion. Ein mit dem MD5- oder SHA1-Algorithmus signiertes Zwischenzertifikat wird f\u00e4lschlicherweise als vertrauensw\u00fcrdig eingestuft, so dass der Browser auf einem System mit aktivierter ESET-Funktion zur \u00dcberpr\u00fcfung des sicheren Datenverkehrs dazu veranlasst wird, einer mit einem solchen Zertifikat gesicherten Website zu vertrauen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T029295",
          "T029294",
          "T029293"
        ]
      },
      "release_date": "2023-12-21T23:00:00.000+00:00",
      "title": "CVE-2023-5594"
    }
  ]
}

CVE-2023-5594 (GCVE-0-2023-5594)

Vulnerability from cvelistv5 – Published: 2023-12-21 11:30 – Updated: 2024-08-02 08:07

Title

Improper following of a certificate's chain of trust in ESET security products

Summary

Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

ESET ENISA root

References

1 reference

URL	Tags
https://support.eset.com/en/ca8562-eset-customer-…

Impacted products

13 products

Vendor	Product	Version
ESET, spol. s r.o.	ESET NOD32 Antivirus	Unaffected: 1464
ESET, spol. s r.o.	ESET Internet Security	Unaffected: 1464
ESET, spol. s r.o.	ESET Smart Security Premium	Unaffected: 1464
ESET, spol. s r.o.	ESET Security Ultimate	Unaffected: 1464
ESET, spol. s r.o.	ESET Endpoint Antivirus	Unaffected: 1464
ESET, spol. s r.o.	ESET Endpoint Security	Unaffected: 1464
ESET, spol. s r.o.	ESET Endpoint Antivirus for Linux 10.0 and above	Unaffected: 1464
ESET, spol. s r.o.	ESET Server Security for Windows Server	Unaffected: 1464
ESET, spol. s r.o.	ESET Mail Security for Microsoft Exchange Server	Unaffected: 1464
ESET, spol. s r.o.	ESET Mail Security for IBM Domino	Unaffected: 1464
ESET, spol. s r.o.	ESET Security for Microsoft SharePoint Server	Unaffected: 1464
ESET, spol. s r.o.	ESET File Security for Microsoft Azure	Unaffected: 1464
ESET, spol. s r.o.	ESET Server Security for Linux 10.1 and above	Unaffected: 1464

Date Public

2023-12-20 11:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:07:32.481Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.eset.com/en/ca8562-eset-customer-advisory-improper-following-of-a-certificates-chain-of-trust-in-eset-security-products-fixed"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET NOD32 Antivirus",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Internet Security",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Smart Security Premium",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Security Ultimate",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Endpoint Antivirus",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Endpoint Security",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Endpoint Antivirus for Linux 10.0 and above",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Server Security for Windows Server",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Mail Security for Microsoft Exchange Server",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Mail Security for IBM Domino",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Security for Microsoft SharePoint Server",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET File Security for Microsoft Azure",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Internet protection module"
          ],
          "product": "ESET Server Security for Linux 10.1 and above ",
          "vendor": "ESET, spol. s r.o.",
          "versions": [
            {
              "status": "unaffected",
              "version": "1464"
            }
          ]
        }
      ],
      "datePublic": "2023-12-20T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper validation of the server\u2019s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted."
            }
          ],
          "value": "Improper validation of the server\u2019s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Man in the Middle Attack"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-21T11:30:41.256Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "url": "https://support.eset.com/en/ca8562-eset-customer-advisory-improper-following-of-a-certificates-chain-of-trust-in-eset-security-products-fixed"
        }
      ],
      "source": {
        "advisory": "ca8562",
        "discovery": "UNKNOWN"
      },
      "title": "Improper following of a certificate\u0027s chain of trust\u202fin ESET security products",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2023-5594",
    "datePublished": "2023-12-21T11:30:41.256Z",
    "dateReserved": "2023-10-16T08:12:50.985Z",
    "dateUpdated": "2024-08-02T08:07:32.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2023-3211

CVE-2023-5594 (GCVE-0-2023-5594)

Tags

Sightings

Nomenclature

Related by attack behaviour