PT-2021-2363 · Trend Micro · Advanced Threat Scan Engine+1

Published 2021-03-02 · Updated 2021-09-08 · CVE-2021-25252

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) (affected versions not specified)

Description The issue is related to incorrect memory cleanup or deallocation, which may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-400

Related Identifiers

BDU:2021-01601

CVE-2021-25252

Affected Products

Advanced Threat Scan Engine

Virus Scan Api

References · 7

• https://bdu.fstec.ru/vul/2021-01601 · Security Note
• https://success.trendmicro.com/solution/000285675 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25252 · Security Note
• https://vuldb.com/?id.170647 · Note
• https://t.me/cvenotify/11872 · Telegram Post
• https://t.me/cibsecurity/24393 · Telegram Post