SB2023020957 - Multiple vulnerabilities in Trend Micro Apex One

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Insecure DLL loading (CVE-ID: CVE-2023-25143)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner in the Trend Micro Apex One Server installer. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into launching the installer file and execute arbitrary code on victim's system.

2) Improper access control (CVE-ID: CVE-2023-25144)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in the Trend Micro Apex One agent. A local user can create arbitrary directories with arbitrary ownership and escalate privileges on the system.

3) Link following (CVE-ID: CVE-2023-25145)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following within the NT Apex One RealTime Scan Service. A local user can create a specially crafted link to a critical file on the system and escalate privileges.

4) Link following (CVE-ID: CVE-2023-25146)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following within the Apex One NT RealTime Scan service. A local user can create a specially crafted link to a critical file on the system and escalate privileges.

5) Insufficient verification of data authenticity (CVE-ID: CVE-2023-25147)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient verification of data authenticity. A local user with administrative privileges can inject a specially crafted .DLL file during the update process.

6) Link following (CVE-ID: CVE-2023-25148)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following in the security agent. A local user can create a specially crafted link to a critical file on the system and escalate privileges.

Remediation

Install update from vendor's website.

References

• https://success.trendmicro.com/dcx/s/solution/000292209?language=en_US
• https://www.zerodayinitiative.com/advisories/ZDI-23-171/
• https://www.zerodayinitiative.com/advisories/ZDI-23-174/
• https://www.zerodayinitiative.com/advisories/ZDI-23-172/
• https://www.zerodayinitiative.com/advisories/ZDI-23-173/