Views:

Release Date: February 18, 2018
CVE Vulnerability Identifier: CVE-2016-1669
Platform(s): Windows OS


Summary

Trend Micro has released a hotfix for the Trend Micro Security 2017 (version 11.0) family which resolves a vulnerability, that if exploited could allow an attack to run arbitrary code on a vulnerable system.

The latest version of Trend Micro Security 2019 (version 15) is NOT affected by this vulnerability.

Affected version(s)

Product Affected version(s) Platform Language(s
Premium Security 11.0 and below Microsoft Windows English
Maximum Security 11.0 and below Microsoft Windows English
Internet Security 11.0 and below Microsoft Windows English
Antivirus+ Security 11.0 and below Microsoft Windows English

Solution

Trend Micro has two solutions for affected systems:

  1. Trend Micro Security 2019 (all versions) is NOT affected by this vulnerability, and customers are highly encouraged to upgrade to the latest version if they have not already done so.
    For the complete instructions on how to upgrade, go to our Knowledge Base article: Upgrading Trend Micro Security to the latest version.
  2. For customers who cannot upgrade to the latest version (2019), Trend Micro has released a hotfix for Trend Micro Security 2017 (version 11) to resolve the issue, which must be applied manually:

     

    Product Versions Solution Platform
    All Trend Micro Security 2017 products (version 11) Install Hotfix Windows OS

Vulnerability Details

This hotfix includes a mitigation for a vulnerability (CVE-2016-1669) that may allow an attacker to execute arbitrary code which could cause certain services to crash and lead to denial-of-service (DOS). As mentioned above, the latest version (2019) of Trend Micro Security is not affected.

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

Mitigating Factors

Exploiting these type of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

External Reference(s)

Home Support

Security Bulletin: Trend Micro Maximum Security 2017 Regex Matching Use-After-Free Remote Code Execution Vulnerability

Release Date: February 18, 2018
CVE Vulnerability Identifier: CVE-2016-1669
Platform(s): Windows OS


Summary

Trend Micro has released a hotfix for the Trend Micro Security 2017 (version 11.0) family which resolves a vulnerability, that if exploited could allow an attack to run arbitrary code on a vulnerable system.

The latest version of Trend Micro Security 2019 (version 15) is NOT affected by this vulnerability.

Affected version(s)

Product Affected version(s) Platform Language(s
Premium Security 11.0 and below Microsoft Windows English
Maximum Security 11.0 and below Microsoft Windows English
Internet Security 11.0 and below Microsoft Windows English
Antivirus+ Security 11.0 and below Microsoft Windows English

Solution

Trend Micro has two solutions for affected systems:

  1. Trend Micro Security 2019 (all versions) is NOT affected by this vulnerability, and customers are highly encouraged to upgrade to the latest version if they have not already done so.
    For the complete instructions on how to upgrade, go to our Knowledge Base article: Upgrading Trend Micro Security to the latest version.
  2. For customers who cannot upgrade to the latest version (2019), Trend Micro has released a hotfix for Trend Micro Security 2017 (version 11) to resolve the issue, which must be applied manually:

     

    Product Versions Solution Platform
    All Trend Micro Security 2017 products (version 11) Install Hotfix Windows OS

Vulnerability Details

This hotfix includes a mitigation for a vulnerability (CVE-2016-1669) that may allow an attacker to execute arbitrary code which could cause certain services to crash and lead to denial-of-service (DOS). As mentioned above, the latest version (2019) of Trend Micro Security is not affected.

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

Mitigating Factors

Exploiting these type of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

External Reference(s)


Was this helpful?

  • It was very helpful.
  • It was helpful.
  • Just okay.
  • It was not helpful.
  • It wasn't helpful at all.
Messenger Icon
Ask Vanessa

Reach out our Social Media ambassador and she'll answer your question or issue.

Hi there  👋

How can we help today? Click me to start chatting with support.

Close
Trend Micro Support

Our Support Representative will be with you shortly.

Product Image

Trend Micro Support

Usually replies in few minutes

Before we start. Kindly fill up details below

Please see our privacy policy for more information on howwe use your data.