Multiple vulnerabilities in Trend Micro Apex One



Published: 2022-09-13 | Updated: 2022-09-14
Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2022-40139
CVE-2022-40140
CVE-2022-40141
CVE-2022-40142
CVE-2022-40143
CVE-2022-40144
CWE-ID CWE-345
CWE-310
CWE-59
CWE-287
Exploitation vector Network
Public exploit Vulnerability #1 is being exploited in the wild.
Vulnerable software
Subscribe
Apex One
Client/Desktop applications / Antivirus software/Personal firewalls

Vendor Trend Micro

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Insufficient verification of data authenticity

EUVDB-ID: #VU67207

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-40139

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to improper input validation within the rollback functionality. A remote authenticated user with access to the administrative console can force the agent into downloading unverified rollback components and compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://success.trendmicro.com/jp/solution/000291471
http://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Insufficient verification of data authenticity

EUVDB-ID: #VU67208

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-40140

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to source validation error within the Apex One NT Listener service. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://success.trendmicro.com/jp/solution/000291471
http://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553
http://www.zerodayinitiative.com/advisories/ZDI-22-1189/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Cryptographic issues

EUVDB-ID: #VU67209

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-40141

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to unspecified error, related to data transport. A remote attacker can decrypt certain communication with the application and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://success.trendmicro.com/jp/solution/000291471
http://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Link following

EUVDB-ID: #VU67210

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-40142

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following. A local user can create a specially crafted link on the system and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://success.trendmicro.com/jp/solution/000291471
http://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553
http://www.zerodayinitiative.com/advisories/ZDI-22-1190/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Link following

EUVDB-ID: #VU67211

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-40143

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following. A local user can create a specially crafted symbolic link on the system and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://success.trendmicro.com/jp/solution/000291471
http://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553
http://www.zerodayinitiative.com/advisories/ZDI-22-1191/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Improper Authentication

EUVDB-ID: #VU67212

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-40144

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://success.trendmicro.com/jp/solution/000291471
http://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###