SB2023020957 - Multiple vulnerabilities in Trend Micro Apex One

Description

This security bulletin contains information about 6 vulnerabilities.

1) Insecure DLL loading (CVE-ID: CVE-2023-25143)

CWE-ID: CWE-427 - Uncontrolled Search Path Element

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner in the Trend Micro Apex One Server installer. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into launching the installer file and execute arbitrary code on victim's system.

2) Improper access control (CVE-ID: CVE-2023-25144)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in the Trend Micro Apex One agent. A local user can create arbitrary directories with arbitrary ownership and escalate privileges on the system.

3) Link following (CVE-ID: CVE-2023-25145)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following within the NT Apex One RealTime Scan Service. A local user can create a specially crafted link to a critical file on the system and escalate privileges.

4) Link following (CVE-ID: CVE-2023-25146)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following within the Apex One NT RealTime Scan service. A local user can create a specially crafted link to a critical file on the system and escalate privileges.

5) Insufficient verification of data authenticity (CVE-ID: CVE-2023-25147)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient verification of data authenticity. A local user with administrative privileges can inject a specially crafted .DLL file during the update process.

6) Link following (CVE-ID: CVE-2023-25148)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following in the security agent. A local user can create a specially crafted link to a critical file on the system and escalate privileges.

Remediation

Install update from vendor's website.

References

• https://success.trendmicro.com/dcx/s/solution/000292209?language=en_US
• https://www.zerodayinitiative.com/advisories/ZDI-23-171/
• https://www.zerodayinitiative.com/advisories/ZDI-23-174/
• https://www.zerodayinitiative.com/advisories/ZDI-23-172/
• https://www.zerodayinitiative.com/advisories/ZDI-23-173/