Multiple vulnerabilities in Trend Micro Apex One

1) Windows Hard Link

EUVDB-ID: #VU46135

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24556

CWE-ID: CWE-65 - Windows hard link

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Windows improperly handles hard links within the ApexOne Security Agent. A local user can create a hard link and abuse the service to overwrite the contents of a chosen file, leading to an elevated status.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

CPE2.3

• cpe:2.3:a:trend_micro:apex_one:2019:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-20-1093/
https://success.trendmicro.com/solution/000263632

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Windows Hard Link

EUVDB-ID: #VU46138

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24559

CWE-ID: CWE-65 - Windows hard link

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Windows improperly handles hard links within the ApexOne Security Agent. A local user can create a hard link and abuse the service to overwrite the contents of a chosen file, leading to an elevated status.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

CPE2.3

• cpe:2.3:a:trend_micro:apex_one:2019:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-20-1096/
https://success.trendmicro.com/solution/000263632

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU46137

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24558

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within OfcPIPC_64x.dll. A local user can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and cause a denial of service condition on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

CPE2.3

• cpe:2.3:a:trend_micro:apex_one:2019:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-20-1095/
https://success.trendmicro.com/solution/000263632

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU46136

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2020-24557

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the ApexOne Security Agent. A local user can manipulate a particular product folder to disable the security temporarily and gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

CPE2.3

• cpe:2.3:a:trend_micro:apex_one:2019:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-20-1094/
https://success.trendmicro.com/solution/000263632
https://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4126

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

5) Windows Hard Link

EUVDB-ID: #VU52480

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-24562

CWE-ID: CWE-65 - Windows hard link

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Windows improperly handles hard links within the ApexOne Security Agent. A local user can create a hard link and abuse the service to overwrite the contents of a chosen file, leading to an elevated status.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

CPE2.3

• cpe:2.3:a:trend_micro:apex_one:2019:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-20-1093/
https://success.trendmicro.com/solution/000263632

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.