Vulnerability · Published Aug 5, 2020 · Assigned by trendmicro
CVE-2020-8607
Medium 6.7
In plain English
A medium-severity security flaw in Trend Micro Anti-Threat Toolkit (ATTK) from Trend Micro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trend Micro | Trend Micro Apex One | 2019 (On premise), SaaS |
| Trend Micro | Trend Micro OfficeScan | XG SP1 |
| Trend Micro | Trend Micro Deep Security | 12.x, 11.x. 10.x |
| Trend Micro | Trend Micro Worry-Free Business Security | 10.0 SP1, Services (SaaS) |
| Trend Micro | Trend Micro Security (Consumer Family) | 2020 (v16), 2019 (v15) |
| Trend Micro | Trend Micro Safe Lock | 2.0 SP1, TXOne Ed |
| Trend Micro | Trend Micro ServerProtect | SPFS 6.0, SPNAF 5.8, SPEMC 5.8, SPNT 5.8 |
| Trend Micro | Trend Micro Portable Security | 3.x, 2.x |
| Trend Micro | Trend Micro HouseCall | 8.0 |
| Trend Micro | Trend Micro Anti-Threat Toolkit (ATTK) | 1.62.1240 and below |
| Trend Micro | Trend Micro Rootkit Buster | 2.2 |
References
- https://success.trendmicro.com/solution/000260713 x_refsource_MISC
- https://success.trendmicro.com/jp/solution/000260748 x_refsource_MISC
- https://jvn.jp/vu/JVNVU99160193/ x_refsource_MISC
- https://jvn.jp/en/vu/JVNVU99160193/index.html x_refsource_MISC