PT-2020-16197 · Trend Micro · Trend Micro Apex One+1

Jaehun Jeong + 1 · Published 2020-09-25 · Updated 2020-10-02 · CVE-2020-25773

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified) Trend Micro OfficeScan (affected versions not specified)

Description A vulnerability in the ServerMigrationTool component could allow an attacker to execute arbitrary code on affected products. This requires user interaction, where the target must import a corrupted configuration file.

Recommendations For Trend Micro Apex One, avoid importing configuration files from untrusted sources until a fix is available. For Trend Micro OfficeScan, restrict access to the ServerMigrationTool component to minimize the risk of exploitation. As a temporary workaround, consider disabling the import functionality of the ServerMigrationTool component until a patch is available.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2020-25773

ZDI-20-1224

Affected Products

Trend Micro Apex One

Trend Micro Officescan

References · 4

• https://success.trendmicro.com/solution/000271974 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1224 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25773 · Security Note