SB2022110957 - Multiple vulnerabilities in Trend Micro Apex One
Published: November 9, 2022 Updated: November 23, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2022-44647)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A locla user can trigger an out-of-bounds read error and read contents of memory on the system.
2) Out-of-bounds read (CVE-ID: CVE-2022-44648)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A locla user can trigger an out-of-bounds read error and read contents of memory on the system.
3) Out-of-bounds write (CVE-ID: CVE-2022-44649)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Unauthorized Change Prevention service. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
4) Buffer overflow (CVE-ID: CVE-2022-44650)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Unauthorized Change Prevention service. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.
5) Race condition (CVE-ID: CVE-2022-44651)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition within the Apex One Client Plug-in Service Manager. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
6) Improper handling of exceptional conditions (CVE-ID: CVE-2022-44652)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper handling of errors in Trend Micro Apex One Security Agent A local user can execute arbitrary code with elevated privileges.
7) Path traversal (CVE-ID: CVE-2022-44653)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to input validation error within the Apex One Client Plug-in Service Manager. A local user can escalate privileges on the system.
8) Security features bypass (CVE-ID: CVE-2022-44654)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to presence of a monitor engine component that is complied without the /SAFESEH memory protection mechanism, which helps to monitor for malicious payloads. A remote attacker can abuse this to perform a denial of service attack against the antimalware engine.
Remediation
Install update from vendor's website.
References
- https://success.trendmicro.com/dcx/s/solution/000291770?language=en_US
- https://www.zerodayinitiative.com/advisories/ZDI-22-1617/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1618/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1619/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1616/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1620/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1621/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1622/