CVE-2020-8607 - An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode

Back Back to CVE browser

MEDIUM

An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode

Published Aug 5, 2020

6.7

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.

Affected products

Vendor Trend Micro Product Trend Micro Anti-Threat Toolkit (ATTK) Default
n/a
- Version
  1.62.1240 and below
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Apex One Default
n/a
- Version
  2019 (On premise), SaaS
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Deep Security Default
n/a
- Version
  12.x, 11.x. 10.x
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro HouseCall Default
n/a
- Version
  8.0
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro OfficeScan Default
n/a
- Version
  XG SP1
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Portable Security Default
n/a
- Version
  3.x, 2.x
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Rootkit Buster Default
n/a
- Version
  2.2
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Safe Lock Default
n/a
- Version
  2.0 SP1, TXOne Ed
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Security (Consumer Family) Default
n/a
- Version
  2020 (v16), 2019 (v15)
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro ServerProtect Default
n/a
- Version
  SPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8
  Status
  affected
  Constraints
  -
Vendor Trend Micro Product Trend Micro Worry-Free Business Security Default
n/a
- Version
  10.0 SP1, Services (SaaS)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trend Micro

Trend Micro Anti-Threat Toolkit (ATTK)

n/a

Version	Status	Constraints
1.62.1240 and below	affected	-

Trend Micro

Trend Micro Apex One

n/a

Version	Status	Constraints
2019 (On premise), SaaS	affected	-

Trend Micro

Trend Micro Deep Security

n/a

Version	Status	Constraints
12.x, 11.x. 10.x	affected	-

Trend Micro

Trend Micro HouseCall

n/a

Version	Status	Constraints
8.0	affected	-

Trend Micro

Trend Micro OfficeScan

n/a

Version	Status	Constraints
XG SP1	affected	-

Trend Micro

Trend Micro Portable Security

n/a

Version	Status	Constraints
3.x, 2.x	affected	-

Trend Micro

Trend Micro Rootkit Buster

n/a

Version	Status	Constraints
2.2	affected	-

Trend Micro

Trend Micro Safe Lock

n/a

Version	Status	Constraints
2.0 SP1, TXOne Ed	affected	-

Trend Micro

Trend Micro Security (Consumer Family)

n/a

Version	Status	Constraints
2020 (v16), 2019 (v15)	affected	-

Trend Micro

Trend Micro ServerProtect

n/a

Version	Status	Constraints
SPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8	affected	-

Trend Micro

Trend Micro Worry-Free Business Security

n/a

Version	Status	Constraints
10.0 SP1, Services (SaaS)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29455
Advisory
https://jvn.jp/en/vu/JVNVU99160193/index.html
x_refsource_MISCThird Party Advisory
https://jvn.jp/vu/JVNVU99160193/
x_refsource_MISCThird Party Advisory
https://success.trendmicro.com/jp/solution/000260748
x_refsource_MISCVendor Advisory
https://success.trendmicro.com/solution/000260713
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29455		Advisory
https://jvn.jp/en/vu/JVNVU99160193/index.html		x_refsource_MISCThird Party Advisory
https://jvn.jp/vu/JVNVU99160193/		x_refsource_MISCThird Party Advisory
https://success.trendmicro.com/jp/solution/000260748		x_refsource_MISCVendor Advisory
https://success.trendmicro.com/solution/000260713		x_refsource_MISCPatchVendor Advisory