CVE-2018-15363: Trend Micro Maximum Security ID_AMSP_MASTER Out-Of-Bounds Read Privilege Escalation Vulnerability
An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of request ID 0x2002 for IDAMSPMASTER in the service process coreServiceShell.exe. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15363?
The severity of CVE-2018-15363 is high with a CVSS score of 7.8.
How does CVE-2018-15363 affect Trend Micro Maximum Security?
CVE-2018-15363 affects Trend Micro Maximum Security with versions up to and including 12.0.
What is the vulnerability description of CVE-2018-15363?
CVE-2018-15363 is a privilege escalation vulnerability in Trend Micro Maximum Security that allows local attackers to escalate privileges by executing low-privileged code.
How can an attacker exploit CVE-2018-15363?
An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit CVE-2018-15363.
How can I fix CVE-2018-15363?
To fix CVE-2018-15363, it is recommended to update Trend Micro Maximum Security to version 12.0 or higher.