Published:2019/11/11  Last Updated:2020/02/06

JVNVU#91935870
Multiple vulnerabilities in Trend Micro Anti-Threat Toolkit (ATTK)

Overview

Trend Micro Anti-Threat Toolkit (ATTK) contains remote code execution and privilege escalation vulnerabilities.

Products Affected

  • Trend Micro Anti-Threat Toolkit (ATTK) 1.62.0.1218 and earlier

Description

Trend Micro Anti-Threat Toolkit (ATTK) provided by Trend Micro Incorporated contains multiple vulnerabilities listed below.

  • CVE-2019-9491
    Arbitary code may be excuted by placing malicious files in the same directory as executable files.
    CVSS v3 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H Base Score: 7.5
    CVSS v2 AV:L/AC:M/Au:S/C:P/I:P/A:P Base Score: 4.1
  • CVE-2019-20358
    Arbitary code may be excuted or privilege escalation may be conducted by placing malicious files in the same directory as executable files.
    CVSS v3 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H Base Score: 7.5
    CVSS v2 AV:L/AC:M/Au:S/C:P/I:P/A:P Base Score: 4.1

Impact

An attacker may execute arbitrary code or conduct privilege escalation by placing malicious files in the same directory as executable files.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Vendor Status

Vendor Link
Trend Micro Incorporated SECURITY BULLETIN: Trend Micro Anti-Threat Toolkit (ATTK) RCE Vulnerability

References

JPCERT/CC Addendum

This note is released as "Trend Micro Anti-Threat Toolkit (ATTK) vulnerable to remote code execution" on 2019/11/11. Because of a discovery of CVE-2019-20358, we added the informations about CVE-2019-20358 and update this note as "Multiple vulnerabilities in Trend Micro Anti-Threat Toolkit (ATTK)".

Vulnerability Analysis by JPCERT/CC

Credit

Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Trend Micro Incorporated coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2019-9491
CVE-2019-20358
JVN iPedia

Update History

2020/02/06
Added informations about CVE-2019-20358 under the section [Title], [Overview], [Description], [Impact], [JPCERT/CC Addendum], and [Other Information].