CVE-2019-9491

Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.

Score

CVSS 3.1 7.8 High

Status

Modified - security@trendmicro.com

Published

2019-10-21

Last modified

2024-08-04

Weaknesses

CWE-427

Affected products

• Trend Micro Anti-threat Toolkit Attk (Trend Micro)
• Anti-threat Toolkit (Trendmicro)

References

• http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-%28ATTK%29-REMOTE-CODE-EXECUTION.txt
• http://packetstormsecurity.com/files/156160/TrendMicro-Anti-Threat-Toolkit-Improper-Fix.html
• http://seclists.org/fulldisclosure/2019/Oct/42
• http://seclists.org/fulldisclosure/2020/Jan/50
• https://seclists.org/bugtraq/2019/Oct/30
• https://seclists.org/bugtraq/2020/Jan/55
• https://success.trendmicro.com/solution/000149878