Description
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Trend Micro | Trend Micro Apex One | 2019 (On premise), SaaS | — |
| Trend Micro | Trend Micro OfficeScan | XG SP1 | — |
| Trend Micro | Trend Micro Deep Security | 12.x, 11.x. 10.x | — |
| Trend Micro | Trend Micro Worry-Free Business Security | 10.0 SP1, Services (SaaS) | — |
| Trend Micro | Trend Micro Security (Consumer Family) | 2020 (v16), 2019 (v15) | — |
| Trend Micro | Trend Micro Safe Lock | 2.0 SP1, TXOne Ed | — |
| Trend Micro | Trend Micro ServerProtect | SPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8 | — |
| Trend Micro | Trend Micro Portable Security | 3.x, 2.x | — |
| Trend Micro | Trend Micro HouseCall | 8.0 | — |
| Trend Micro | Trend Micro Anti-Threat Toolkit (ATTK) | 1.62.1240 and below | — |
| Trend Micro | Trend Micro Rootkit Buster | 2.2 | — |