Lucene search

[email protected]CVE-2019-14686

HistoryAug 21, 2019 - 8:15 p.m.

CVE-2019-14686

2019-08-2120:15:12

CWE-427

[email protected]

web.nvd.nist.gov

trend micro

security

2019

dll hijacking

vulnerability

nvd

folder shield

ransom buster

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

27.2%

JSON

A DLL hijacking vulnerability exists in the Trend Micro Security’s 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micro Ransom Buster (1.0) tool in which, if exploited, would allow an attacker to load a malicious DLL, leading to elevated privileges.

Affected configurations

NVD

Node

trendmicroantivirus_\+_security_2019Match15.0

trendmicrointernet_security_2019Match15.0

trendmicromaximum_security_2019Match15.0

trendmicropremium_security_2019Match15.0

trendmicroransom_busterMatch1.0

AND

microsoftwindowsMatch-

VendorProductVersionCPE
trendmicromaximum_security_201915.0cpe:/a:trendmicro:maximum_security_2019:15.0:::
trendmicroransom_buster1.0cpe:/a:trendmicro:ransom_buster:1.0:::
trendmicroantivirus_%2B_security_201915.0cpe:/a:trendmicro:antivirus_%2B_security_2019:15.0:::
trendmicropremium_security_201915.0cpe:/a:trendmicro:premium_security_2019:15.0:::
trendmicrointernet_security_201915.0cpe:/a:trendmicro:internet_security_2019:15.0:::

Vendor	Product	Version	CPE
trendmicro	maximum_security_2019	15.0	cpe:/a:trendmicro:maximum_security_2019:15.0:::
trendmicro	ransom_buster	1.0	cpe:/a:trendmicro:ransom_buster:1.0:::
trendmicro	antivirus_%2B_security_2019	15.0	cpe:/a:trendmicro:antivirus_%2B_security_2019:15.0:::
trendmicro	premium_security_2019	15.0	cpe:/a:trendmicro:premium_security_2019:15.0:::
trendmicro	internet_security_2019	15.0	cpe:/a:trendmicro:internet_security_2019:15.0:::

CNA Affected

[
  {
    "product": "Trend Micro Ransom Buster, Trend Micro Security (Consumer)",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "Ransom Buster 1.0, Trend Micro Security 2019 (v15.0)"
      }
    ]
  }
]

References

esupport.trendmicro.com/en-us/home/pages/technical-support/1123421.aspx

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

27.2%

JSON

Related for CVE-2019-14686

prion1 nvd1 cvelist1