====================================================================

                             CERT-Renater

                 Note d'Information No. 2019/VULN387

_____________________________________________________________________

DATE                : 06/12/2019

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):Systems running Trend Micro Antivirus+ Security 2020
                                   Trend Micro Internet Security - 2020,
                                   Trend Micro Maximum Security - 2020,
                                   Trend Micro Premium Security - 2020.

=====================================================================
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124011.aspx
_____________________________________________________________________


SECURITY BULLETIN: Trend Micro Security (Consumer) DLL Hijacking
Vulnerability

    Solution ID:1124011 Last Updated:nov.. 19, 2019 5:44 (PST) Applies
to:Antivirus+ Security - 2020;Internet Security - 2020;Maximum Security
- 2020;Premium Security - 2020;

Release Date: November 25, 2019

CVE Vulnerability Identifiers: CVE-2019-15628

Platform: Windows

CVSS 3.0 Scores: 4.0

Severity Ratings: Medium


Summary

Trend Micro has released a new build for the Trend Micro Security 2020
(version 16.0) family of consumer products which resolve a DLL hijacking
vulnerability.


Affected Versions

Product      Affected Versions     Platform     Language

Premium Security 	2020 (v16.0.1221) and below 	Windows 	English

Maximum Security 	2020 (v16.0.1221) and below 	Windows 	English

Internet Security 	2020 (v16.0.1221) and below 	Windows 	English

Antivirus+ Security 	2020 (v16.0.1221) and below 	Windows 	English


Solution

Trend Micro has released a new build of the tool to resolve this issue:

Product	    Updated Version    Platform     Language

All Trend Micro Security Versions above 	16.0.1227 	Windows 	English


Trend Micro has addressed these vulnerabilities via a patch that is
available now through the product’s automatic ActiveUpdate feature
for all products listed above. Customers who receive regular automatic
updates from the Internet should have already received the update.
Customers who have not yet received the update can manually click Update
Now to ensure they have the latest build. Customers who are still using
Trend Micro Security 2019 (v15) and below can download Trend Micro
Security 2020 (v16) here.


Vulnerability Details

The vulnerability could allow an attacker to use a specific service as
an execution and/or persistence mechanism which could execute a
malicious program each time the service is started.

Trend Micro has received no reports nor is aware of any actual attacks
against the affected product related to this vulnerability at this time.


Acknowledgement

Trend Micro would like to thank the following individual for responsibly
disclosing the issue and working with Trend Micro to help protect our
customers:

    Peleg Hadar of SafeBreach Labs
    Trần Văn Khang (aka Khang Kì Tổ) - Infiniti Team, VinCSS (a member
     of Vingroup)


Additional Assistance

Customers who have questions are encouraged to contact Trend Micro
Technical Support for further assistance.


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================