PT-2020-15735 · Trend Micro · Trend Micro Security 2019

Satoshi Mimura · Published 2020-09-24 · Updated 2020-09-30 · CVE-2020-24560

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Security 2019 version 15

Description The issue is related to an incomplete SSL server certification validation, which could be exploited by an attacker to trick an affected client into downloading a malicious update. This is due to improper server certificate verification in the communication with the update server.

Recommendations For Trend Micro Security 2019 version 15, ensure proper server certificate verification is in place to prevent malicious updates. As a temporary workaround, consider restricting communication with the update server until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-24560

Affected Products

Trend Micro Security 2019

References · 6

• https://osv.dev/vulnerability/CVE-2020-24560 · Vendor Advisory
• https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24560 · Security Note
• https://helpcenter.trendmicro.com/en-us/article/TMKA-09890 · Vendor Advisory
• https://jvn.jp/jp/JVN60093979 · Note
• https://jvn.jp/en/jp/JVN60093979 · Note