Lucene search

[email protected]CVE-2018-18333

HistoryFeb 05, 2019 - 10:29 p.m.

CVE-2018-18333

2019-02-0522:29:00

CWE-426

[email protected]

web.nvd.nist.gov

cve-2018-18333

dll hijacking

trend micro security

consumer

privilege escalation

vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.6%

JSON

A DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163 and below could allow an attacker to manipulate a specific DLL and escalate privileges on vulnerable installations.

Affected configurations

NVD

Node

trendmicroantivirus_\+_securityRange<15.0.0.1163

trendmicrointernet_securityRange<15.0.0.1163

trendmicromaximum_securityRange<15.0.0.1163

trendmicropremium_securityRange<15.0.0.1163

AND

microsoftwindowsMatch-

CPENameOperatorVersion
trendmicro:antivirus_\+_securitytrendmicro antivirus + securitylt15.0.0.1163
trendmicro:internet_securitytrendmicro internet securitylt15.0.0.1163
trendmicro:maximum_securitytrendmicro maximum securitylt15.0.0.1163
trendmicro:premium_securitytrendmicro premium securitylt15.0.0.1163

CPE	Name	Operator	Version
trendmicro:antivirus_\+_security	trendmicro antivirus + security	lt	15.0.0.1163
trendmicro:internet_security	trendmicro internet security	lt	15.0.0.1163
trendmicro:maximum_security	trendmicro maximum security	lt	15.0.0.1163
trendmicro:premium_security	trendmicro premium security	lt	15.0.0.1163

CNA Affected

[
  {
    "product": "Trend Micro Security (Consumer)",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "Versions below 15.0.0.1163"
      }
    ]
  }
]

References

esupport.trendmicro.com/en-us/home/pages/technical-support/1121932.aspx

gaissecurity.com/yazi/discovery-of-dll-hijack-on-trend-micro-antivirusplus-cve-2018-18333

kaganisildak.com/2019/01/17/discovery-of-dll-hijack-on-trend-micro-antivirus-cve-2018-18333/

Social References

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.6%

JSON

Related for CVE-2018-18333

nvd1 prion1 cvelist1