Affected Version(s)

Solution

Trend Micro has released the following solutions to address the issue:

Please note that Trend Micro highly encourages customers to obtain the latest version of the product if there is a newer one available than the one listed in this bulletin to ensure all known issues are resolved.

Customers are encouraged to visit Trend Micro’s Download Center to obtain prerequisite software (such as Service Packs) before applying any of the solutions above.

Vulnerability Details

CVE-2023-52090:  Agent Engine Link Following Local Privilege Escalation Vulnerability 
ZDI-CAN-21425
CVSSv3: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2023-52091:  Anti-Spyware Engine Link Following Local Privilege Escalation Vulnerability 
ZDI-CAN-21522
CVSSv3: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2023-52092:  Security Agent Link Following Local Privilege Escalation Vulnerability 
ZDI-CAN-21346
CVSSv3: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2023-52093:  Exposed Dangerous Function Local Privilege Escalation Vulnerability 
ZDI-CAN-21860
CVSSv3: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2023-52094:  Updater Link Following Local Privilege Escalation Vulnerability 
ZDI-CAN-21896
CVSSv3: 7.0: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Mitigating Factors

Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.

However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible.

Acknowledgement

Trend Micro would like to thank the following individuals for responsibly disclosing these issues and working with Trend Micro to help protect our customers:

• NT AUTHORITY\ANONYMOUS LOGON working with Trend Micro's Zero Day Initiative (CVE-2023-52090 through CVE-2023-52092, CVE-2023-52094)
• Lays (@_L4ys) of TRAPA Security working with Trend Micro's Zero Day Initiative (CVE-2023-52093)

External Reference(s)

• ZDI-CAN-21425
• ZDI-CAN-21522
• ZDI-CAN-21346
• ZDI-CAN-21860
• ZDI-CAN-21896