Lucene search

[email protected]CVE-2021-25252

HistoryMar 03, 2021 - 4:15 p.m.

CVE-2021-25252

2021-03-0316:15:13

CWE-400

[email protected]

web.nvd.nist.gov

cve-2021-25252

trend micro

virus scan api

advanced threat scan engine

memory exhaustion

denial of service

nvd

4.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Trend Micro’s Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.

Affected configurations

NVD

Node

microsoftwindowsMatch-

AND

trendmicroapex_centralMatch2019-

Node

microsoftwindowsMatch-

AND

trendmicroapex_oneMatch2019-

Node

trendmicrocloud_edgeMatch5.0

Node

applemacosMatch-

AND

trendmicroapex_oneMatch--

Node

trendmicrodeep_securityMatch10.0-

trendmicrodeep_securityMatch11.0-

trendmicrodeep_securityMatch12.0-

trendmicrodeep_securityMatch20.0-long_term_support

Node

microsoftwindowsMatch-

AND

trendmicrocontrol_managerMatch7.0-

Node

trendmicrodeep_discovery_analyzerMatch5.1-

Node

trendmicrodeep_discovery_email_inspectorMatch2.5-

Node

trendmicrodeep_discovery_inspectorMatch3.8-

Node

trendmicrointerscan_messaging_security_virtual_applianceMatch9.1-

Node

trendmicrointerscan_web_security_virtual_applianceMatch6.5-

Node

microsoftwindowsMatch-

AND

trendmicroofficescanMatch-

Node

trendmicroportal_protectMatch2.6

AND

microsoftwindowsMatch-

Node

trendmicroscanmailMatch14.0microsoft_exchange

AND

microsoftwindowsMatch-

Node

trendmicroscanmail_for_ibm_dominoMatch5.8-

AND

linuxlinux_kernelMatch-

microsoftwindowsMatch-

Node

trendmicroserverprotect_for_storageMatch6.0-

AND

microsoftwindowsMatch-

Node

trendmicroserverprotectMatch5.8-

AND

emccelerra_network_attached_storageMatch-

microsoftwindowsMatch-

novellnetwareMatch-

Node

trendmicroserverprotect_for_network_appliance_filersMatch5.8-

AND

netappcluster_data_ontapMatch-

Node

trendmicrosafe_lockMatch1.1-txone

AND

microsoftwindowsMatch-

Node

trendmicroworry-free_business_securityMatch10.1-

AND

microsoftwindowsMatch-

CPENameOperatorVersion
trendmicro:apex_centraltrendmicro apex centraleq2019

CPE	Name	Operator	Version
trendmicro:apex_central	trendmicro apex central	eq	2019

CNA Affected

[
  {
    "product": "Trend Micro Virus Scan API (VSAPI) Engine\r\n",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "12.0"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000285675

4.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for CVE-2021-25252

osv1 nvd1 prion1 cvelist1