SB2022110957 - Multiple vulnerabilities in Trend Micro Apex One
Published: November 9, 2022 Updated: November 23, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2022-44647)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A locla user can trigger an out-of-bounds read error and read contents of memory on the system.
2) Out-of-bounds read (CVE-ID: CVE-2022-44648)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A locla user can trigger an out-of-bounds read error and read contents of memory on the system.
3) Out-of-bounds write (CVE-ID: CVE-2022-44649)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Unauthorized Change Prevention service. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
4) Buffer overflow (CVE-ID: CVE-2022-44650)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Unauthorized Change Prevention service. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.
5) Race condition (CVE-ID: CVE-2022-44651)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition within the Apex One Client Plug-in Service Manager. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
6) Improper handling of exceptional conditions (CVE-ID: CVE-2022-44652)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper handling of errors in Trend Micro Apex One Security Agent A local user can execute arbitrary code with elevated privileges.
7) Path traversal (CVE-ID: CVE-2022-44653)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to input validation error within the Apex One Client Plug-in Service Manager. A local user can escalate privileges on the system.
8) Security features bypass (CVE-ID: CVE-2022-44654)
CWE-ID: CWE-254 - Security Features
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to presence of a monitor engine component that is complied without the /SAFESEH memory protection mechanism, which helps to monitor for malicious payloads. A remote attacker can abuse this to perform a denial of service attack against the antimalware engine.
Remediation
Install update from vendor's website.
References
- https://success.trendmicro.com/dcx/s/solution/000291770?language=en_US
- https://www.zerodayinitiative.com/advisories/ZDI-22-1617/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1618/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1619/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1616/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1620/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1621/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1622/