The Kaspersky SecureList security team has reported that the ToddyCat APT group is currently exploiting a vulnerability in ESET products. Specifically, it involves an incorrect DLL search order, also known as DLL proxying.
This vulnerability allows attackers to place crafted DLL files in a directory where a legitimate DLL should normally be loaded. When the ESET Command Line Scanner or a similar process is launched, the system searches the directories for DLLs in the specified order. If a folder containing controlled, crafted DLLs is found earlier in the search order than the folder containing the original DLL, the crafted version is loaded instead of the genuine component. This method allows ToddyCat to inject malicious code into the context of an otherwise trustworthy security solution.
ESET reacted immediately
In parallel with these findings, ESET has published an official security advisory. This information details the DLL Search Order Hijacking vulnerability in ESET products for Windows. It explains that the flaw lies in the way the affected system searches for DLLs.
Specifically, it is pointed out that an attacker capable of placing manipulated DLLs in directories can influence which DLL is ultimately loaded when the affected scanner is run. To prevent this attack, ESET has already released an update that corrects the incorrect DLL search order. Users of the affected ESET products are therefore urgently advised to update to the latest versions. According to ESET, the following versions are affected:
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthPatches are ready
- ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate 18.0.12.0 and earlier
- ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows 12.0.2038.0, 11.1.2053.2 and earlier
- ESET Small Business Security and ESET Safe Server 18.0.12.0 and earlier
- ESET Server Security for Windows Server (formerly File Security for Microsoft Windows Server) 11.1.12005.2 and earlier
- ESET Mail Security for Microsoft Exchange Server 11.1.10008.0, 11.0.10008.0, 10.1.10014.0 and earlier
- ESET Security for Microsoft SharePoint Server 11.1.15001.0, 11.0.15004.0, 10.0.15005.1 and earlier
These incidents impressively demonstrate that even software from established security vendors is not completely immune to sophisticated attack techniques. The targeted exploitation of the DLL proxying method underscores the importance of regularly using the latest software versions to close known vulnerabilities. ESET responded quickly with the update, thus consistently eliminating the attack option via the manipulated search order.
More at Kaspersky.com
About Kaspersky Kaspersky is an international cybersecurity company founded in 1997. Kaspersky's in-depth threat intelligence and security expertise serve as the basis for innovative security solutions and services to protect companies, critical infrastructures, governments and private users worldwide. The company's comprehensive security portfolio includes leading endpoint protection as well as a range of specialized security solutions and services to defend against complex and evolving cyber threats. Kaspersky technologies protect over 400 million users and 250.000 corporate customers. More information about Kaspersky can be found at www.kaspersky.com/