Release Date: July 5, 2018
CVE Vulnerability Identifiers: CVE-2018-3608
Platform: Windows
CVSS 3.0 Scores: 7.2
Severity Ratings: High
Summary
Trend Micro has released fixes for the Trend Micro Security 2018 (version 12.0) family of consumer products which resolve a vulnerability in a certain driver that if exploited, could allow an attacker to inject malicious code into processes on a vulnerable system.
Affected versions
| Product | Affected Versions | Platform | Language(s) |
|---|---|---|---|
| Premium Security | 12.0.1191 and below | Microsoft Windows | English |
| Maximum Security | 12.0.1191 and below | Microsoft Windows | English |
| Internet Security | 12.0.1191 and below | Microsoft Windows | English |
| Antivirus + Security | 12.0.1191 and below | Microsoft Windows | English |
Solution
| Product | Updated Build | Platform | Language(s) |
|---|---|---|---|
| All Versions Above | 12.0.1226 | Microsoft Windows | English |
Trend Micro has addressed these vulnerabilities via a patch that is available now through the product’s automatic ActiveUpdate feature for all versions of Trend Micro Security 2018 (version 12) listed above. Customers who have at least version 12.0.1226 (as of July 5th) will already have the necessary patch applied.
Vulnerability Details
This patch includes mitigations for the following vulnerabilities:
- CVE-2018-3608: A vulnerability exists in the Trend Micro User-Mode Hooking (UMH) driver in which, if exploited, would allow an attacker to create a specially crafted packet that could alter a vulnerable system in such a way that malicious code could be injected into other processes.
Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.
Mitigating Factors
Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.
Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to upgrade to the latest build as soon as possible.
Acknowledgement
Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:
- Zhiyuan Wang of Chengdu Qihoo360 Tech Co. Ltd