CVE-2024-3779: 
NixOS vulnerability analysis and mitigation

A denial of service vulnerability (CVE-2024-3779) was discovered in ESET security products for Windows. The vulnerability was identified by Ali Jammal of Deloitte Netherlands and Alaa Kachouh of Mastercard, and was present shortly after product installation or upgrade. The issue could potentially allow an attacker to render ESET's security product inoperable, provided specific non-default preconditions were met (ESET Advisory).

The vulnerability stems from incorrect access permissions that could allow an attacker to delete certain files required for the product's protection functionality. This vulnerability could only be exploited during the product initialization phase, shortly after product installation or manual upgrade via an installation file that didn't include all product modules. The vulnerability has a CVSS v3.1 score of 6.1 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H (ESET Advisory).

If successfully exploited, the vulnerability would cause the security product to become inoperable after the next system reboot. The impact was limited to systems where the product was initially installed to a custom (non-default) path and only during specific installation conditions (ESET Advisory).

ESET has released fixed versions of their affected products. The recommended versions are: ESET NOD32 Antivirus, Internet Security, Smart Security Premium, and Security Ultimate 17.2.7.0 and later; ESET Endpoint Antivirus and Endpoint Security for Windows 11.1.2039.0 and later; ESET Server Security for Windows Server 11.0.12012.0 and later; ESET Mail Security for Microsoft Exchange Server 11.0.10008.0 and later; and ESET Security for Microsoft SharePoint Server 11.0.15004.0 and later (ESET Advisory).