SECURITY BULLETIN: Trend Micro Security (Consumer) 2019 DLL Hijacking Vulnerability

  • Solution ID:1121932
  • Last Updated:Jan. 23, 2019 9:04 PM (PST)
  • Applies to:Antivirus+ Security - 2019;Internet Security - 2018;Maximum Security - 2019;Premium Security - 2019;
Release Date: January 17, 2019
CVE Vulnerability Identifiers: CVE-2018-18333
Platform: Windows OS
CVSS 3.0 Scores: 6.6 
Severity Ratings: Medium

Summary

Trend Micro has released updated installer builds for the Trend Micro Security 2019 (version 15.0) family of consumer products which resolves a DLL hijacking vulnerability that could allow an attacker to escalate privileges on a vulnerable system that they would otherwise not have access to.

 

Affected versions
ProductAffected VersionsPlatformLanguage(s)
Premium Security Versions below 15.0.0.1163 Microsoft Windows English
Maximum Security
Versions below 15.0.0.1163
Microsoft Windows English
Internet Security
Versions below 15.0.0.1163
Microsoft Windows English
Antivirus + Security
Versions below 15.0.0.1163
Microsoft Windows English

 

Solution
ProductUpdated BuildPlatformLanguage(s)
All Versions At or Above  15.0.0.1163 Microsoft Windows English

 

Trend Micro has addressed these vulnerabilities via updated installer builds that are available now for download.  Customers are highly encouraged to upgrade to the latest version if they have not already done so.  

For complete instructions on how to upgrade, please visit our Knowledge Base article:  Upgrading Trend Micro Security to the latest version.

 

Vulnerability Details:

The updated build resolves a DLL hijacking vulnerability that could allow a user to manipulate a specific DLL and escalate privileges on a vulnerable system.

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

 

Mitigating Factors

Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

 

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

  • Kağan IŞILDAK (@kaganisildak) of Gais Security
External References

The following advisories may be found by visiting the following sites:

CVE
CVE-2018-18333
Additional Assistance

Customers who have questions are encouraged to contact Trend Micro Technical Support for further assistance.