Firmware is a software embedded on a hardware device that controls how the device behaves. New firmware often fixes bugs, contains new features, and protects you from security vulnerabilities.
Updating your device’s firmware can help improve your device's security. It is always recommended to install the latest available updates to keep your network safe and efficient.
Summary
Trend Micro has released fixes for the Trend Micro Security 2018 (version 12.0) family of consumer products resolving vulnerabilities that could allow an attacker to escalate privileges on a vulnerable system that they would otherwise not have access to.
Affected versions
| Product | Affected Versions | Platform | Language(s) |
|---|---|---|---|
| Premium Security | 12.0 and below | Microsoft Windows | English |
| Maximum Security | 12.0 and below | Microsoft Windows | English |
| Internet Security | 12.0 and below | Microsoft Windows | English |
| Antivirus + Security | 12.0 and below | Microsoft Windows | English |
Solution
| Product | Updated Build | Platform | Language(s) |
|---|---|---|---|
| All Versions At or Above | 12.0.1226 | Microsoft Windows | English |
Trend Micro has addressed these vulnerabilities via a patch that is available now through the product’s automatic ActiveUpdate feature for all versions of Trend Micro Security 2018 (version 12) listed above. Customers who have at least version 12.0.1226 (as of August 2018) will already have the necessary patch applied.
Vulnerability Details
This patch includes mitigations for the following vulnerabilities:
- CVE-2018-10513: Deserialization of Untrusted Data Privilege Escalation vulnerability
- CVE-2018-10514: Missing Impersonation Privilege Escalation vulnerability
- CVE-2018-15363: Out-of-Bounds Read Privilege Escalation vulnerability
Trend Micro has received no reports nor is aware of any actual attacks against the affected products related to this vulnerability at this time.
Mitigating Factors
Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine.
Even though an exploit may require several specific conditions to be met, Trend Micro bly encourages customers to upgrade to the latest build as soon as possible.
Acknowledgement
Trend Micro would like to thank the following individuals and/or organizations for responsibly disclosing these issues and working with Trend Micro to help protect our customers:
- Anonymous working with Trend Micro's Zero Day Initiative
External References
The following advisories may be found by visiting the following sites:
CVEs - https://cve.mitre.org/cve/cve.html
ZDI Advisories - Trend Micro's Zero Day Initiative Published Advisories
| CVE | ZDI Case(s) |
| CVE-2018-10513 | ZDI-18-961 |
| CVE-2018-10514 | ZDI-18-962 |
| CVE-2018-15363 | ZDI-18-963 |
