Trend Micro has patched a couple of security flaws in its Password Manager credential management product that gave attackers a way to escalate privileges and gain persistence on systems running the software.
In a security advisory Wednesday, the security vendor described the issue as involving two DLL hijacking vulnerabilities in the company's stand-alone version of the product and the version that comes integrated with the latest version of its anti-malware suite.
One of the now-patched vulnerabilities (CVE-2019-14684) would have allowed an attacker to load an arbitrary file with malicious code into the password manager. The other separate but similar vulnerability (CVE-2019-14687), also allowed attackers to load malicious code but using a different DLL.
The flaws existed in Trend Micro's 2019 versions of Password Manager, Maximum Security, and Premium Security products for Windows computers. The security vendor has issued a patch that is currently available to users who have signed up for automatic updates. Others can get the patch by manually updating their software to the latest build.
"Exploiting these types of vulnerabilities require that an attacker has access (physical or remote) to a vulnerable machine," Trend Micro said. Even though an exploit would likely require several specific conditions to exist, organizations should still upgrade to the latest build as soon as possible, the company advised.
Attractive to Attackers
Peleg Hadar, security researcher at SafeBreach Labs, the security firm that originally discovered and reported the vulnerabilities, says certain features in Trend Micro's Password Manager make it interesting for attackers.
For instance, the product runs as the most ..
Support the originator by clicking the read the rest link below.
