Release Date: October 19, 2018
CVE Vulnerability Identifiers: CVE-2018-15366, CVE-2018-15367, CVE-2018-18327, CVE-2018-18328, CVE-2018-18329
Platform: macOS
CVSS 3.0 Scores: 6.9
Severity Ratings: Medium
Summary
Trend Micro has released fixes for the Trend Micro Antivirus for Mac family of consumer products which resolve vulnerabilities that could allow an attacker to escalate privileges on a vulnerable system that they otherwise would not have had access to.
Affected versions
| Product | Affected Versions | Platform | Language(s) |
|---|---|---|---|
| Antivirus for Mac 2019 | 9.0.1356 and below | macOS | English |
| Antivirus for Mac 2018 | 8.0.3082 and below | macOS | English |
| Antivirus for Mac 2017 | 7.1.1124 and below | macOS | English |
Solution
| Product | Updated Build | Platform | Language(s) |
|---|---|---|---|
| All Versions Above | Any version above 7.0 | macOS | English |
Trend Micro has addressed these vulnerabilities via a patch that is available now through the product’s automatic ActiveUpdate feature for all versions of Trend Micro Antivirus for Mac listed above. Customers who have at least version 7.0 will already have the necessary patch applied with the latest update.
Vulnerability Details
This patch includes mitigations for the following vulnerabilities:
- CVE-2018-15366: Use-After-Free Privilege Escalation Vulnerability
- CVE-2018-15367, CVE-2018-18327, CVE-2018-18328, CVE-2018-18329: Untrusted Pointer Dereference Privilege Escalation Vulnerability
Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.
Mitigating Factors
Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.
Even though an exploit may require several specific conditions to be met, Trend Micro bly encourages customers to upgrade to the latest build as soon as possible.
Acknowledgement
Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:
- Anonymous working with Trend Micro's Zero Day Initiative
External References
The following advisories may be found by visiting the following sites:
- CVEs - https://cve.mitre.org/cve/cve.html
- ZDI Advisories - Trend Micro's Zero Day Initiative Published Advisories
| CVE | ZDI Case |
|---|---|
| CVE-2018-15366 | ZDI-18-1293 |
| CVE-2018-15367 | ZDI-18-1294 |
| CVE-2018-18327 | ZDI-18-1295 |
| CVE-2018-18328 | ZDI-18-1296 |
| CVE-2018-18329 | ZDI-18-1297 |