Insecure DLL loading in Trend Micro uiAirSupport

1) Insecure DLL loading

EUVDB-ID: #VU86023

Risk: Medium

CVSSv3.1: 8.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2024-23940

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote user can place a specially crafted .dll file and execute arbitrary code on victim's system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Premium Security - uiAirSupport: 6.0.2092

Maximum Security - uiAirSupport: 6.0.2092

Internet Security - uiAirSupport: 6.0.2092

Antivirus + Security - uiAirSupport: 6.0.2092

External links

http://helpcenter.trendmicro.com/en-us/article/tmka-12134
http://helpcenter.trendmicro.com/ja-jp/article/tmka-12132
http://medium.com/@s1kr10s/av-when-a-friend-becomes-an-enemy-55f41aba42b1
http://jvn.jp/en/vu/JVNVU99844997/index.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.