Description
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
Affected products
- Trend Micro / Trend Micro Anti-Threat Toolkit (ATTK)1.62.1240 and below – 1.62.1240 and below
- Trend Micro / Trend Micro Apex One2019 (On premise), SaaS – 2019 (On premise), SaaS
- Trend Micro / Trend Micro Deep Security12.x, 11.x. 10.x – 12.x, 11.x. 10.x
- Trend Micro / Trend Micro HouseCall8.0 – 8.0
- Trend Micro / Trend Micro OfficeScanXG SP1 – XG SP1
- Trend Micro / Trend Micro Portable Security3.x, 2.x – 3.x, 2.x
- Trend Micro / Trend Micro Rootkit Buster2.2 – 2.2
- Trend Micro / Trend Micro Safe Lock2.0 SP1, TXOne Ed – 2.0 SP1, TXOne Ed
- Trend Micro / Trend Micro Security (Consumer Family)2020 (v16), 2019 (v15) – 2020 (v16), 2019 (v15)
- Trend Micro / Trend Micro ServerProtectSPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8 – SPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8
- Trend Micro / Trend Micro Worry-Free Business Security10.0 SP1, Services (SaaS) – 10.0 SP1, Services (SaaS)