Vulnerabilites related to ESET - CompuSec
cve-2018-0649
Vulnerability from cvelistv5
Published
2018-09-07 14:00
Modified
2024-08-05 03:35
Severity ?
Summary
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
References
http://jvn.jp/en/jp/JVN41452671/index.htmlthird-party-advisory, x_refsource_JVN
https://eset-support.canon-its.jp/faq/show/10720?site_domain=defaultx_refsource_CONFIRM
Impacted products
Vendor Product Version
Canon IT Solutions Inc. The installers of multiple Canon IT Solutions Inc. software programs Version: (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:35:48.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#41452671",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN41452671/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "The installers of multiple Canon IT Solutions Inc. software programs",
          "vendor": "Canon IT Solutions Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))"
            }
          ]
        }
      ],
      "datePublic": "2018-07-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Untrusted search path vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-07T13:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#41452671",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN41452671/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-0649",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "The installers of multiple Canon IT Solutions Inc. software programs",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "(ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones))"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Canon IT Solutions Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Untrusted search path vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#41452671",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN41452671/index.html"
            },
            {
              "name": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default",
              "refsource": "CONFIRM",
              "url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-0649",
    "datePublished": "2018-09-07T14:00:00",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-08-05T03:35:48.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

jvndb-2018-000083
Vulnerability from jvndb
Published
2018-07-24 14:43
Modified
2019-07-26 12:05
Severity ?
7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
The installers of multiple Canon IT Solutions Inc. software programs may insecurely load Dynamic Link Libraries
Details
The installers of multiple software programs provided by Canon IT Solutions Inc. contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427). Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
JVN http://jvn.jp/en/jp/JVN41452671/index.html
JVN https://jvn.jp/en/ta/JVNTA91240916/
CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0649
NVD https://nvd.nist.gov/vuln/detail/CVE-2018-0649
No Mapping(CWE-Other) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
ESETCompuSec
ESETDESlock+ Pro
ESETESET Internet Security
ESETESET NOD32 Antivirus
ESETESET Smart Security
ESETESET Smart Security Premium
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000083.html",
  "dc:date": "2019-07-26T12:05+09:00",
  "dcterms:issued": "2018-07-24T14:43+09:00",
  "dcterms:modified": "2019-07-26T12:05+09:00",
  "description": "The installers of multiple software programs provided by Canon IT Solutions Inc. contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).\r\n\r\nYuji Tounai of NTT Communications Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000083.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:eset:compusec",
      "@product": "CompuSec",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:deslock%2b_pro",
      "@product": "DESlock+ Pro",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:internet_security",
      "@product": "ESET Internet Security",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:nod32_antivirus",
      "@product": "ESET NOD32 Antivirus",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:smart_security",
      "@product": "ESET Smart Security",
      "@vendor": "ESET",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:eset:smart_security_premium",
      "@product": "ESET Smart Security Premium",
      "@vendor": "ESET",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000083",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN41452671/index.html",
      "@id": "JVN#41452671",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/ta/JVNTA91240916/",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0649",
      "@id": "CVE-2018-0649",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0649",
      "@id": "CVE-2018-0649",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "The installers of multiple Canon IT Solutions Inc. software programs may insecurely load Dynamic Link Libraries"
}

Vulnerability from fkie_nvd
Published
2018-09-07 14:29
Modified
2024-11-21 03:38
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
References
vultures@jpcert.or.jphttp://jvn.jp/en/jp/JVN41452671/index.htmlThird Party Advisory, VDB Entry
vultures@jpcert.or.jphttps://eset-support.canon-its.jp/faq/show/10720?site_domain=defaultMitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://jvn.jp/en/jp/JVN41452671/index.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://eset-support.canon-its.jp/faq/show/10720?site_domain=defaultMitigation, Vendor Advisory
Impacted products
Vendor Product Version
eset compusec -
eset deslock\+_pro -
eset internet_security -
eset nod32_antivirus -
eset smart_security -
eset smart_security_premium -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eset:compusec:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "63B943DB-777D-4FC3-9E52-6798C1D9D449",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:deslock\\+_pro:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5E9CA87-AC2E-442D-A1ED-16EE7F843DDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:internet_security:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2CAD248-1F32-4459-A530-8706E334C67F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:nod32_antivirus:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6253FAFB-0AE6-494A-950D-EB0EB15E982C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_security:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3145062C-7BBA-41FE-9C2C-3B4B5464C4C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eset:smart_security_premium:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "66086537-418D-4295-8AC9-E33CF947F598",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ruta de b\u00fasqueda no fiable en los instaladores de m\u00faltiples programas de software de Canon IT Solutions Inc. (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro y CompuSec; todos los programas menos los empaquetados) permite que un atacante obtenga privilegios mediante un archivo DLL troyano en un directorio sin especificar."
    }
  ],
  "id": "CVE-2018-0649",
  "lastModified": "2024-11-21T03:38:39.803",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-09-07T14:29:01.617",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://jvn.jp/en/jp/JVN41452671/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://jvn.jp/en/jp/JVN41452671/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://eset-support.canon-its.jp/faq/show/10720?site_domain=default"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}