Multiple vulnerabilities in Trend Micro Worry-Free Business Security

Published: 2021-07-28

Risk	Critical
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2021-36741 CVE-2021-36742
CWE-ID	CWE-434 CWE-119
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Vulnerability #2 is being exploited in the wild.
Vulnerable software Subscribe	Worry-Free Business Security Client/Desktop applications / Software for system administration
Vendor	Trend Micro

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Arbitrary file upload

EUVDB-ID: #VU55408

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-36741

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the product’s management console . A remote user can upload a malicious file and execute it on the server.

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Worry-Free Business Security: 10 SP1 Patch 2203 - 10.0 SP1 B2190

External links

http://success.trendmicro.com/solution/000287820
http://files.trendmicro.com/documentation/wfbs/10.0/WFBS_100_SP1_WIN_ALL_Patch_2329.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Buffer overflow

EUVDB-ID: #VU55409

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-36742

CWE-ID: CWE-119 - Memory corruption