CRITICAL SECURITY BULLETIN: September 2022 Security Bulletin for Trend Micro Apex One

Summary

Release Date: Sept. 13, 2022
CVE Identifier(s): CVE-2022- 40139 through CVE-2022-40144
Platform(s): Windows
CVSS 3.0 Score(s): 5.5 – 8.2
Severity Rating(s): Medium – High

Trend Micro has released a new Service Pack for Trend Micro Apex One (On Premise) and Critical Patches for Apex One as a Service (SaaS) that resolve multiple vulnerabilities in the product.

Please note – Trend Micro has observed at least one active attempt of potential attacks against at least one of these vulnerabilities in the wild (ITW) – details below. Customers are strongly encouraged to update to the latest versions as soon as possible.

Affected Version(s)

Solution

Trend Micro has released the following solutions to address the issue:

These are the minimum recommended version(s) of the patches and/or builds required to address the issue. Trend Micro highly encourages customers to obtain the latest version of the product if there is a newer one available than the one listed in this bulletin.

* Please note that some of the vulnerabilities listed below were addressed in earlier monthly SaaS updates, but Trend Micro recommends that Apex One as a Service customers are always on the latest available build to ensure all issues are properly resolved.

Customers are encouraged to visit Trend Micro’s Download Center to obtain prerequisite software (such as Service Packs) before applying any of the solutions above.

Vulnerability Details

CVE-2022-40139:  Improper Validation of Rollback Mechanism Components RCE Vulnerability 
CVSSv3: 7.2: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution.

Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

ITW Alert: Trend Micro has observed at least one active attempt of potential exploitation of this vulnerability in the wild.

CVE-2022-40140:  Origin Validation Error Denial-of-Service Vulnerability 
ZDI-CAN-16314
CVSSv3: 5.5: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2022-40141:  Information Disclosure Vulnerability 
CVSSv3: 5.6: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contain some identification attributes of a particular Apex One server.

CVE-2022-40142:  Agent Link Following Local Privilege Escalation Vulnerability 
ZDI-CAN-16691
CVSSv3: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2022-40143:  Link Following Local Privilege Escalation Vulnerability 
ZDI-CAN-16435
CVSSv3: 7.3: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbitrary code with elevated privileges.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2022-40144:  Login Authentication Bypass Vulnerability 
JVN#36454862
CVSSv3: 8.2: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product’s login authentication by falsifying request parameters on affected installations.

Mitigating Factors

Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.

However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible.

Acknowledgement

Trend Micro would like to thank the following individuals for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

• CVE-2022-40139: Trend Micro Research (Internal)
• CVE-2022-40140: Simon Zuckerbraun of Trend Micro’s Zero Day Initiative
• CVE-2022-40141: Elias Martinez (Eli.Martinez67 [at] Outlook.com)
• CVE-2022-40142 and 40143: Abdelhamid Naceri working with Trend Micro’s Zero Day Initiative
• CVE-2022-40144: Akinori Takeuchi of Cyber Defense Institute, Inc.

External Reference(s)

The following advisories may be found at Trend Micro’s Zero Day Initiative Published Advisories site:

• ZDI-CAN-16314
• ZDI-CAN-16691
• ZDI-CAN-16435

The following advisory may be found at Japan Vulnerability Notes (JVN) :

• JVN#36454862
  
  Source :
  https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US