Insecure DLL Loading issue in multiple Trend Micro products


Multiple products provided by Trend Micro Incorporated contain an insecure DLL loading issue (CWE-427).
When invoking the installers of other applications while the concerned products are installed to the PC, the DLL placed in the same directory as the the installers (of the other applications) may be insecurely loaded.

Hidenori Ohta of Mitsubishi Electric Information Systems Corporation reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products

Trend Micro, Inc.
  • Trend Micro Deep Security 10.0
  • Trend Micro Deep Security 10.1 (Feature Release)
  • Trend Micro Endpoint Sensor 1.6
  • Trend Micro Security (Consumer) All 2018 (v12) Versions
  • OfficeScan Version 11.0
  • OfficeScan XG (Version 12)
  • Worry-Free Business Security Version 9.5 (Standard/Advanced)
  • Worry-Free Business Security Services


Arbitrary code may be executed with the privilege of the user invoking the installer of other applications.

[Apply the Patch]
Apply the patch according to the information provided by the developer.
Vendor Information

Trend Micro, Inc.
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2018-6218

  1. JVN : JVN#28865183
  2. JVN : JVNTA#91240916
  3. National Vulnerability Database (NVD) : CVE-2018-6218
  4. IPA SECURITY ALERTS : Security Alert for Vulnerability in multiple Trend Micro products (JVN#28865183) (in Japanese)
Revision History

  • [2018/02/15]
      Web page was published
  • [2018/04/11]
      References : Content was added