JVNDB-2021-002077

[Japanese]
JVNDB-2021-002077
Multiple vulnerabilities in multiple Trend Micro Endpoint security products for enterprises
Overview
Multiple Endpoint security products for enterprises provided by Trend Micro Incorporated contain multiple vulnerabilities listed below. * Incorrect Permission Assignment (CWE-732) - CVE-2021-32464 * Improper Preservation of Permissions (CWE-281) - CVE-2021-32465 * Improper Input Validation (CWE-20) - CVE-2021-36741 * Improper Input Validation (CWE-20) - CVE-2021-36742 Trend Micro Incorporated states that attacks against CVE-2021-36741 and CVE-2021-36742 have been observed. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.
CVSS Severity (What is CVSS?)
CVSS V3 Severity: Base Metrics 7.8 (High) [Other] Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High CVSS V2 Severity: Base Metrics 7.2 (High) [NVD Score] Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete The above CVSS base scores have been assigned for CVE-2021-32464
CVSS V3 Severity: Base Metrics:7.5 (High) [Other] Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High The above CVSS base scores have been assigned for CVE-2021-32465
CVSS V3 Severity: "Base Metrics:7.1 (High) [Other] Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality Impact: None Integrity Impact: Low Availability Impact: The above CVSS base scores have been assigned for CVE-2021-36741
CVSS V3 Severity: Base Metrics:7.8 (High) [Other] Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High The above CVSS base scores have been assigned for CVE-2021-36742
Affected Products

Trend Micro, Inc. Apex One On Premise (2019) prior to Build 9601 Apex One as a Service prior to Build 202107 Worry-Free Business Security 10 SP1 prior to Build 2329 Worry-Free Business Security Services prior to 6.7.1538 / 14.2.1295
For details on products affected by this vulnerability, please refer to the Vendor Information and References.
Impact
* An attacker who can log in to the OS where the product is running may obtain SYSTEM privileges and as a result, a specific script may be altered - CVE-2021-32464 * A remote attacker who can log in to the OS where the product is running may bypass login authentication - CVE-2021-32465 * A remote attacker who can log in to the product may upload arbitrary files - CVE-2021-36741 * An attacker who can log in to the OS where the product is running may obtain SYSTEM privileges - CVE-2021-36742
Solution
[Apply the Patch] Apply the patch according to the information provided by the developer. The developer has released the patches listed below that contain a fix for these vulnerabilities. * Apex One On Premise (2019) Critical Patch B9601 * Worry-Free Business Security 10 SP1 Patch B2329 * Worry-Free Business Security Services 6.7.1538 / 14.2.1295 and later The issues in Apex One as a Service are already fixed in the July 21th, 2021 updates. [Apply the Workaround] Applying the following workaround may mitigate the impact of these vulnerabilities. * Permit access to the product to only trusted network
Vendor Information
Trend Micro, Inc. TrendMicro Solution : SECURITY BULLETIN: July 28, 2021, Security Bulletin for Trend Micro Apex One and Apex One as a Service TrendMicro Solution : SECURITY BULLETIN: July 28, 2021, Security Bulletin for Worry-Free Business Security TrendMicro Solution : SECURITY BULLETIN: Trend Micro Worry-Free Business Security Services Incorrect Permission Assignment Privilege Escalation Vulnerability TrendMicro Support : [Alert] Apply the latest Critical Patches; An attack exploiting the vulnerabilities (CVE-2021-36741, CVE-2021-36742) in Trend Micro products has been observed (in Japanese)
CWE (What is CWE?)
Improper Input Validation(CWE-20) [Other] Improper Preservation of Permissions(CWE-281) [Other] Incorrect Permission Assignment for Critical Resource(CWE-732) [Other]
CVE (What is CVE?)
CVE-2021-32464 CVE-2021-32465 CVE-2021-36741 CVE-2021-36742
References
JVN : JVNVU#93876919 National Vulnerability Database (NVD) : CVE-2021-32464 National Vulnerability Database (NVD) : CVE-2021-32465 National Vulnerability Database (NVD) : CVE-2021-36742 National Vulnerability Database (NVD) : CVE-2021-36741 JPCERT : JPCERT-AT-2021-0033 (in Japanese) CISA Known Exploited Vulnerabilities Catalog : CVE-2021-36741, CVE-2021-36742
Revision History
[2021/08/04] Web page was published


Date Public	2021/07/29
Date First Published	2021/08/04
Date Last Updated	2021/08/04

Multiple vulnerabilities in multiple Trend Micro Endpoint security products for enterprises