SECURITY BULLETIN: Trend Micro Password Manager DLL Hijacking Vulnerabilities

  • Solution ID:1123396
  • Last Updated:Aug. 15, 2019 1:54 PM (PST)
  • Applies to:Password Manager - 5;
Release Date: August 14, 2019
CVE Vulnerability Identifiers: CVE-2019-14684; CVE-2019-14687
Platform: Windows 
CVSS 3.0 Score: 4.3 
Severity Rating: Medium

 

Bulletin updated on 8/15 to more accurately reflect affected products.

Summary

Trend Micro has released an updated version of Trend Micro Password Manager 5.0 that resolves DLL hijacking vulnerabilities in both the standalone version of the product and the version packaged with the latest versions of Trend Micro Security 2019 (Consumer).

 

Affected versions
ProductAffected VersionsPlatformLanguage(s)
Password Manager* 2019 (Version 5.0) Microsoft Windows English

 *Please note that Trend Micro Security Premium Security 2019 and Maximum Security 2019 also include Password Manager as an optional part of the installation. These versions are identical to the standalone version and have been addressed with the same patch.

Solution
ProductUpdated BuildPlatformLanguage(s)
Password Manager 5.0.0.1058 Microsoft Windows English

 

Trend Micro has addressed these vulnerabilities via a patch that is available now through the product’s automatic ActiveUpdate feature for all products listed above.  Customers who receive regular automatic updates from the Internet should have already received the update.  Customers who have not yet received the update can manually click "Update Now" to ensure they have the latest build.

 

Vulnerability Details:

This patch includes mitigation for the following vulnerabilities:

  • CVE-2019-14684: A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process.
  • CVE-2019-14687:  A separate, but similar DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0, utilizing a separate DLL.  

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

 

Mitigating Factors

Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

 

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

  • Peleg Hadar of SafeBreach Labs
  • Trần Văn Khang (aka Khang Kì Tổ) from Infiniti Team, VinCSS (a member of Vingroup)
Additional Assistance

Customers who have questions are encouraged to contact Trend Micro Technical Support for further assistance.