Content, Breach

Carbon Black Discovers, Remediates Corner-Case Bug

Carbon Black, a company that specializes in endpoint security and antivirus products, has discovered a corner-case bug that may have affected 10 of its Cb Response incident response and threat hunting software customers, according to a prepared statement. The company has remediated the bug, notified the 10 potentially affected customers and posted a security bulletin.

The corner-case bug was introduced in April and affects users of Cb Response sensor versions 5.2.7+ and 6.0.4+, Carbon Black stated. To trigger the bug, the following conditions must occur:

  • Cb Response must be installed on macOS.
  • A Cb Response sensor must be configured to collect modloads, retrieve a copy of all binaries and upload unknown binaries to the software's multi-scanner.
  • A Cb Response content file must be opened for processing and marked as "executable" either via permissions or when mapped into memory.
  • Processing must take place during system initialization or high file input/output volume.

Within 24 hours of discovering the bug, Carbon Black took steps to prevent content files from being uploaded to the Cb Response multi-scanner, the company indicated. In addition, these files were removed from the multi-scanner's repository.

DirectDefense, an MSP that provides information security services, earlier this month found Cb Response data leaks, the company said in a prepared statement. However, Carbon Black responded to DirectDefense's claims, noting the company "incorrectly asserts an architectural flaw in Cb Response that leaks customer data," co-founder Michael Viscuso stated.

Dan Kobialka

Dan Kobialka is senior contributing editor, MSSP Alert and ChannelE2E. He covers IT security, IT service provider business strategies and partner programs. Dan holds a M.A. in Print and Multimedia Journalism from Emerson College and a B.A. in English from Bridgewater State University. In his free time, Dan enjoys jogging, traveling, playing sports, touring breweries and watching football.