CVE-2018-10359: Trend Micro OfficeScan TMWFP driver Pool Corruption Privilege Escalation Vulnerability
A pool corruption privilege escalation vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within the processing of IOCTL 0x220078 in the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro OfficeScan. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x220078 in the TMWFP driver. The issue results from the lack of proper validation of the length of user-supplied data prior to using that length to initialize a pool-based buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges to kernel.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-10359?
CVE-2018-10359 is a vulnerability in Trend Micro OfficeScan that allows local attackers to escalate privileges.
How can the CVE-2018-10359 vulnerability be exploited?
To exploit CVE-2018-10359, an attacker must first obtain the ability to execute low-privileged code on the target system.
What is the affected software?
The affected software includes Trend Micro OfficeScan versions 11.0 SP1, XG, and XG SP1.
What is the severity of CVE-2018-10359?
CVE-2018-10359 has a severity rating of 6.3 (medium).
How can I fix the CVE-2018-10359 vulnerability?
To fix the CVE-2018-10359 vulnerability, users should follow the recommendations provided by Trend Micro in their solution document.