NOD32 Vulnerabilities

To make that much more clear, none of my reproaches goes against ESET. There are others meant.

 

Before we changed to NOD32 last year, we used the product of another major player in the AV-Industry. We changed to NOD32 because i was sure that ESET reacts fast and that NOD32 is a good product. But after 6 month since 2.7 was released i'm a little bit deflated. NOD32 is still one of the best products, but the reaction time is a slower than the reaction time of the product which we used before NOD32.
When i talked to the distributor, mid April 2007 was announced to release 2.7 via PCU. The non-fixed security hole in the german version confirmed my opinion that something is not optimal.

 

I agree on that

But is there a solution /alternative . Perhaps a point for improvement

 

Thats the part of the german distributor. Or ESET, to make them ( german Distributor ) clear, what they have to do.

Or, for what else the german Distributor gets their money ? However, as jod said, the PCU doesn't work since month. Further also no newer version are offered manually. Also no information is made by the German side. Nothing concerning newer version and nothing over existing exploids. Absolutely nothing, , except, a winner list dated of 02.05.2007. That is the last, official information of the German ESET agency. Congratulations.

 

19/04/2007 - First Vulnerability reported to ESET
19/04/2007 - ESET Response
20/04/2007 - Vulnerability Analysis and PoC sent to ESET
20/04/2007 - ESET initial feedback
24/04/2007 - Confirmed the bug and fixed
07/05/2007 - ESET made available the updates
10/05/2007 - A second vulnerability was founded and reported to ESET with a PoC an analysis
10/05/2007 - ESET response, Confirmed the bug and fixed
15/05/2007 - ESET made available the updates
19/05/2007 - Coordinated public disclosure


If you read the timeline for the disclosure you see that Eset had a fix for the 1st vulnerability for 13 days before they released it and 5 days before they released the fix for the 2nd one.


This a copy n paste from here; http://www.inkatel.com/wp-content/uploads/2007/05/Advisory.txt

 

And what's the point ?

 

That they had the 1st fix for 13 days before it waas released, could have translated any number of languages in that time, same with the .39 fix, that 1 was fixed on the 10th, 14 days ago, again plenty of time for translation, but they say you STILL have to wait a few more days. Like they just found out about this 5 mins ago or something. Additionally, what they are fixing is part of the engine, not the GUI or help files, code is code, there shouldn't be much translating involved.

 

That's exactly how i understand it. So the most important point is, there should't be any translation necessarily. And btw. you can see, other distributors were now ready, others still not.

 

Yes some distributors are simply awesome and go way above and beyond, Blackspear comes to mind here, however others leave much to be desired. In that case, complain to Eset, they are responsible for how their distributors represent them, it isn't the other way around. I don't feel this one shouldn't be a distributor problem. I could be wrong though. Eset writes the code, distirbutors just sell and provide support.

 

Hi,

i just want to ask *when* will the update to NOD32 V2.70.39 released via PCU in german?
I cannot understand why Eset or Datsec need so much time to release an update via PCU. Since our last post was for up to 5 weeks, from my point of view, there has to be enough time for Eset to release an update.
As i posted before, its not an option to update 75 PCs manually, so i have to wait for the pcu...
As i talked to Datsec for 5 weeks, they told me that the pcu update will be released shortly...
Eset and Datsec stated that the risk of the security hole is not so big, but its not good to know if you have pcs with a documented security hole running.

JDO

 

@JDO

they will release it soon whatever this mean...

Try to mail eset and ask 4 a special update server, as described here