description: An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
problem types: Improper Input Validation
affected:
{
product: Trend Micro Apex One
vendor: Trend Micro
versions:
status: affected, version: 2019 (On premise), SaaS
}
{
product: Trend Micro OfficeScan
vendor: Trend Micro
versions:
status: affected, version: XG SP1
}
{
product: Trend Micro Deep Security
vendor: Trend Micro
versions:
status: affected, version: 12.x, 11.x. 10.x
}
{
product: Trend Micro Worry-Free Business Security
vendor: Trend Micro
versions:
status: affected, version: 10.0 SP1, Services (SaaS)
}
{
product: Trend Micro Security (Consumer Family)
vendor: Trend Micro
versions:
status: affected, version: 2020 (v16), 2019 (v15)
}
{
product: Trend Micro Safe Lock
vendor: Trend Micro
versions:
status: affected, version: 2.0 SP1, TXOne Ed
}
{
product: Trend Micro ServerProtect
vendor: Trend Micro
versions:
status: affected, version: SPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8
}
{
product: Trend Micro Portable Security
vendor: Trend Micro
versions:
status: affected, version: 3.x, 2.x
}
{
product: Trend Micro HouseCall
vendor: Trend Micro
versions:
status: affected, version: 8.0
}
{
product: Trend Micro Anti-Threat Toolkit (ATTK)
vendor: Trend Micro
versions:
status: affected, version: 1.62.1240 and below
}
{
product: Trend Micro Rootkit Buster
vendor: Trend Micro
versions:
status: affected, version: 2.2
}
