JVNDB-2018-000013

Insecure DLL Loading issue in multiple Trend Micro products

Multiple products provided by Trend Micro Incorporated contain an insecure DLL loading issue (CWE-427).
When invoking the installers of other applications while the concerned products are installed to the PC, the DLL placed in the same directory as the the installers (of the other applications) may be insecurely loaded.

Hidenori Ohta of Mitsubishi Electric Information Systems Corporation reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Trend Micro, Inc.

• Trend Micro Deep Security 10.0
• Trend Micro Deep Security 10.1 (Feature Release)
• Trend Micro Endpoint Sensor 1.6
• Trend Micro Security (Consumer) All 2018 (v12) Versions
• OfficeScan Version 11.0
• OfficeScan XG (Version 12)
• Worry-Free Business Security Version 9.5 (Standard/Advanced)
• Worry-Free Business Security Services

Arbitrary code may be executed with the privilege of the user invoking the installer of other applications.

[Apply the Patch]
Apply the patch according to the information provided by the developer.

Trend Micro, Inc.

• TrendMicro Solution : Solution Id: 1119326

1. No Mapping(CWE-Other) [IPA Evaluation]

1. CVE-2018-6218

1. JVN : JVN#28865183
2. JVN : JVNTA#91240916
3. National Vulnerability Database (NVD) : CVE-2018-6218
4. IPA SECURITY ALERTS : Security Alert for Vulnerability in multiple Trend Micro products (JVN#28865183) (in Japanese)

• [2018/02/15]
    Web page was published
• [2018/04/11]
    References : Content was added