CVE-2020-8607
Medium
Description
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
SeverityMedium
CVSS6.7
Exploit probability—
ProductTrendmicro Rootkit Buster
PublishedAug 5, 2020
First seenAug 5, 2020
How to fix
Update
- trendmicro antivirus_toolkit1.62.1240 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trendmicro rootkit_buster | 2.2 | — |
| trendmicro antivirus_toolkit | v < 1.62.1240 | 1.62.1240 |
| trendmicro apex_one | 2019, saas | — |
| trendmicro deep_security | 9.6, 10.0, 11.0, 12.0 | — |
| trendmicro officescan | xg | — |
| trendmicro officescan_business_security | 9.0, 9.5, 10.0 | — |
| trendmicro officescan_business_security_service | No range specified | — |
| trendmicro officescan_cloud | 15, 16.0 | — |
| trendmicro online_scan | 8.0 | — |
| trendmicro portable_security | 2.0, 3.0 | — |
| trendmicro safe_lock | No range specified, 2.0 | — |
| trendmicro serverprotect | 5.8, 6.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.