Published:2020/10/06 Last Updated:2020/10/06
JVNVU#95014999
Trend Micro Antivirus for Mac vulnerable to a privilege escalation
Overview
Antivirus for Mac provided by Trend Micro Incorporated contain a privilege escalation vulnerability.
Products Affected
- Antivirus for Mac 2019 (v9.x)
- Antivirus for Mac 2020 (v10.x)
Description
Antivirus for Mac provided by Trend Micro Incorporated contain a symbolic link privilege escalation vulnerability (CWE-61).
Impact
An attacker who can access the product could exploit a crafted symbolic link on the system and may remove arbitrary files and folders.
Solution
Update the software
Apply the appropriate update according to the information provided by the developer.
- Antivirus for Mac 2019 (v9.x)
- The 2019 family (Version 9.x) is no longer supported. The developer recommends users to upgrade to the latest supported version.
- Antivirus for Mac 2020 (v10.x)
- The necessary patch (10.0.1803) is already available. Users of version 10.0 or above already have the patch applied through the product’s automatic ActiveUpdate feature.
Vendor Status
| Vendor | Link |
| Trend Micro Incorporated | Security Bulletin: Trend Micro Antivirus for Mac 2020 (Consumer) Symbolic Link Privilege Escalation Vulnerability |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score:
7.8
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
Credit
Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Trend Micro Incorporated coordinated under the Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2020-25776 |
| JVN iPedia |
|