CVE-2017-5565: Code Injection
Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier), Internet Security 11.0 (and earlier), and Antivirus+ Security 11.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Trend Micro process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5565?
CVE-2017-5565 is classified as a critical severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2017-5565?
To mitigate CVE-2017-5565, upgrade to the latest versions of Trend Micro Maximum Security, Internet Security, or Antivirus+ Security that address this vulnerability.
Who is affected by CVE-2017-5565?
CVE-2017-5565 affects users of Trend Micro Maximum Security, Internet Security, and Antivirus+ Security versions 11.0 and earlier.
What type of attack does CVE-2017-5565 enable?
CVE-2017-5565 allows a local attacker to bypass self-protection mechanisms and inject arbitrary code into any Trend Micro process.
What products are vulnerable in CVE-2017-5565?
The vulnerable products listed under CVE-2017-5565 include Trend Micro Maximum Security, Internet Security, Antivirus+ Security, all at or below version 11.1.1005.