Views:

Release Date: April 4, 2018
Updated: May 2, 2018
CVE Vulnerability Identifiers: CVE-2018-6232 through CVE-2018-6236
Platform: Windows
CVSS 3.0 Scores: 4.6 – 7.2
Severity Ratings: Medium and High


Summary

Trend Micro has released fixes for the Trend Micro Security 2018 (version 12.0) family of consumer products which resolve multiple vulnerabilities that if exploited, could allow an attacker to run arbitrary code or disclose information on a vulnerable system.

Affected versions

Product Affected Versions Platform Language(s)
Premium Security 12.0 and below Microsoft Windows English
Maximum Security 12.0 and below Microsoft Windows English
Internet Security 12.0 and below Microsoft Windows English
Antivirus + Security 12.0 and below Microsoft Windows English

Solution

Trend Micro has addressed these vulnerabilities via a patch that was made available through the product’s automatic ActiveUpdate feature in mid-March 2018 for all versions of Trend Micro Security 2018 (version 12). Customers who have the latest update (12.0.1226 as of March 28, 2018) will already have the necessary patch applied.

Vulnerability Details

This patch includes mitigations for the following vulnerabilities:

  1. CVE-2018-6232: Buffer Overflow Privilege Escalation (READONLY_MEMORY)
  2. CVE-2018-6233: Buffer Overflow Privilege Escalation (BAD_POOL_HEADER)
  3. CVE-2018-6234: Out-Of-Bounds Read Information Disclosure
  4. CVE-2018-6235: Out-Of-Bounds Write Information Disclosure
  5. CVE-2018-6236: Time-Of-Check/Time-Of-Use Privilege Escalation

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

Mitigating Factors

Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

External References

The following advisories may be found at the Trend Micro's Zero Day Initiative Published Advisories site:

CVE-2018-6232 ZDI-18-266
CVE-2018-6233 ZDI-18-267
CVE-2018-6234 ZDI-18-268
CVE-2018-6235 ZDI-18-269
CVE-2018-6236 ZDI-18-418
Comments (2)
  • 1
  • 1
Home Support

Security Bulletin: Trend Micro Security (Consumer) 2018 Multiple Vulnerabilities

Release Date: April 4, 2018
Updated: May 2, 2018
CVE Vulnerability Identifiers: CVE-2018-6232 through CVE-2018-6236
Platform: Windows
CVSS 3.0 Scores: 4.6 – 7.2
Severity Ratings: Medium and High


Summary

Trend Micro has released fixes for the Trend Micro Security 2018 (version 12.0) family of consumer products which resolve multiple vulnerabilities that if exploited, could allow an attacker to run arbitrary code or disclose information on a vulnerable system.

Affected versions

Product Affected Versions Platform Language(s)
Premium Security 12.0 and below Microsoft Windows English
Maximum Security 12.0 and below Microsoft Windows English
Internet Security 12.0 and below Microsoft Windows English
Antivirus + Security 12.0 and below Microsoft Windows English

Solution

Trend Micro has addressed these vulnerabilities via a patch that was made available through the product’s automatic ActiveUpdate feature in mid-March 2018 for all versions of Trend Micro Security 2018 (version 12). Customers who have the latest update (12.0.1226 as of March 28, 2018) will already have the necessary patch applied.

Vulnerability Details

This patch includes mitigations for the following vulnerabilities:

  1. CVE-2018-6232: Buffer Overflow Privilege Escalation (READONLY_MEMORY)
  2. CVE-2018-6233: Buffer Overflow Privilege Escalation (BAD_POOL_HEADER)
  3. CVE-2018-6234: Out-Of-Bounds Read Information Disclosure
  4. CVE-2018-6235: Out-Of-Bounds Write Information Disclosure
  5. CVE-2018-6236: Time-Of-Check/Time-Of-Use Privilege Escalation

Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.

Mitigating Factors

Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.

Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.

Acknowledgement

Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

External References

The following advisories may be found at the Trend Micro's Zero Day Initiative Published Advisories site:

CVE-2018-6232 ZDI-18-266
CVE-2018-6233 ZDI-18-267
CVE-2018-6234 ZDI-18-268
CVE-2018-6235 ZDI-18-269
CVE-2018-6236 ZDI-18-418

Was this helpful?

  • It was very helpful.
  • It was helpful.
  • Just okay.
  • It was not helpful.
  • It wasn't helpful at all.
Messenger Icon
Ask Vanessa

Reach out our Social Media ambassador and she'll answer your question or issue.

Hi there  👋

How can we help today? Click me to start chatting with support.

Close
Trend Micro Support

Our Support Representative will be with you shortly.

Product Image

Trend Micro Support

Usually replies in few minutes

Before we start. Kindly fill up details below

Please see our privacy policy for more information on howwe use your data.