Multiple vulnerabilities in Trend Micro Apex One and OfficeScan

1) Code Injection

EUVDB-ID: #VU26156

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2020-8467

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the migration tool component. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OfficeScan: XG SP1 - XG

Apex One: 2019

CPE2.3

External links

http://success.trendmicro.com/jp/solution/000244253
http://success.trendmicro.com/solution/000245571

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Input validation error

EUVDB-ID: #VU26157

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2020-8468

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a content validation escape issue. A remote authenticated attacker can pass specially crafted input to the application and manipulate certain agent client components.

Note: the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

OfficeScan: XG SP1 - XG

Worry-Free Business Security: 9.5 - 10.0

CPE2.3

External links

http://success.trendmicro.com/jp/solution/000244253
http://success.trendmicro.com/jp/solution/000244836
http://success.trendmicro.com/solution/000245571
http://success.trendmicro.com/solution/000245572

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

3) Insecure DLL loading

EUVDB-ID: #VU26158

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8470

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can use a specially crafted .dll file and delete any file on the server with SYSTEM level privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

OfficeScan: XG SP1 - XG

Worry-Free Business Security: 9.5 - 10.0

CPE2.3

External links

http://success.trendmicro.com/jp/solution/000244253
http://success.trendmicro.com/jp/solution/000244836
http://success.trendmicro.com/solution/000245571
http://success.trendmicro.com/solution/000245572

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Insecure DLL loading

EUVDB-ID: #VU26159

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8598

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can use a specially crafted .dll file and execute arbitrary code on the target system with SYSTEM level privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

OfficeScan: XG SP1 - XG

Worry-Free Business Security: 9.5 - 10.0

CPE2.3

External links

http://success.trendmicro.com/jp/solution/000244253
http://success.trendmicro.com/jp/solution/000244836
http://success.trendmicro.com/solution/000245571
http://success.trendmicro.com/solution/000245572

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU26161

Risk: High

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2020-8599

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to unspecified error, related to input validation. A remote attacker can write arbitrary data to an arbitrary path on affected installations and compromise the affected system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019

OfficeScan: XG SP1 - XG

CPE2.3

External links

http://success.trendmicro.com/jp/solution/000244253
http://success.trendmicro.com/solution/000245571

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

6) Path traversal

EUVDB-ID: #VU26160

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8600

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the "TempFileName" parameter provided to the "cgiRecvFile.exe" endpoint. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system, allowing to manipulate a key file to bypass authentication.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Worry-Free Business Security: 9.5 - 10.0

CPE2.3

External links

http://success.trendmicro.com/jp/solution/000244836
http://success.trendmicro.com/solution/000245572
http://www.zerodayinitiative.com/advisories/ZDI-20-307/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Critical
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2020-8467 CVE-2020-8468 CVE-2020-8470 CVE-2020-8598 CVE-2020-8599 CVE-2020-8600
CWE-ID	CWE-94 CWE-20 CWE-427 CWE-22
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Vulnerability #2 is being exploited in the wild. Vulnerability #5 is being exploited in the wild.
Vulnerable software	OfficeScan Client/Desktop applications / Antivirus software/Personal firewalls Apex One Client/Desktop applications / Antivirus software/Personal firewalls Worry-Free Business Security Client/Desktop applications / Software for system administration
Vendor	Trend Micro