SECURITY BULLETIN: Trend Micro Security (Consumer) 2018 Privilege Escalation Vulnerabilities

  • Solution ID:1120742
  • Last Updated:Jan. 11, 2019 6:02 PM (PST)
  • Applies to:Antivirus+ Security - 2018;Internet Security - 2018;Maximum Security - 2018;Premium Security - 2018;
  • SECURITY BULLETIN | Trend Micro Security (Consumer) 2018 Privilege Escalation Vulnerabilities
Release Date: August 23, 2018 
CVE Vulnerability Identifiers: CVE-2018-10513, CVE-2018-105014, CVE-2018-15363
Platform: Windows OS
CVSS 3.0 Scores: 6.9 - 7.2 
Severity Ratings: Medium and High

Summary

Trend Micro has released fixes for the Trend Micro Security 2018 (version 12.0) family of consumer products resolving vulnerabilities that could allow an attacker to escalate privileges on a vulnerable system that they would otherwise not have access to.

 

Affected versions
ProductAffected VersionsPlatformLanguage(s)
Premium Security 12.0 and below Microsoft Windows English
Maximum Security 12.0 and below Microsoft Windows English
Internet Security 12.0 and below Microsoft Windows English
Antivirus + Security 12.0 and below Microsoft Windows English

 

Solution
ProductUpdated BuildPlatformLanguage(s)
All Versions At or Above  12.0.1226 Microsoft Windows English

 

Trend Micro has addressed these vulnerabilities via a patch that is available now through the product’s automatic ActiveUpdate feature for all versions of Trend Micro Security 2018 (version 12) listed above. Customers who have at least version 12.0.1226 (as of August 2018) will already have the necessary patch applied.

 

Vulnerability Details:

This patch includes mitigations for the following vulnerabilities:

  • CVE-2018-10513: Deserialization of Untrusted Data Privilege Escalation vulnerability
  • CVE-2018-10514: Missing Impersonation Privilege Escalation vulnerability
  • CVE-2018-15363: Out-of-Bounds Read Privilege Escalation vulnerability

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

 

Mitigating Factors

Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

 

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

External References

The following advisories may be found by visiting the following sites:

CVEs - https://cve.mitre.org/cve/cve.html

ZDI Advisories - Trend Micro's Zero Day Initiative Published Advisories

CVE ZDI Case(s)
CVE-2018-10513 ZDI-18-961
CVE-2018-10514 ZDI-18-962
CVE-2018-15363 ZDI-18-963
Additional Assistance

Customers who have questions are encouraged to contact Trend Micro Technical Support for further assistance.