NVD Vulnerability Detail

CVE-2019-9491

Summary	Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
Publication Date	Oct. 22, 2019, 4:15 a.m.
Registration Date	Jan. 26, 2021, 11:45 a.m.
Last Update	Nov. 21, 2024, 1:51 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:trendmicro:anti-threat_toolkit::::::::			1.62.0.1218
execution environment
1	cpe:2.3:o:microsoft:windows:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-%28ATTK%29-REMOTE-CODE-EXECUTION.txt
2	http://packetstormsecurity.com/files/156160/TrendMicro-Anti-Threat-Toolkit-Improper-Fix.html	Exploit Third Party Advisory VDB Entry
3	http://seclists.org/fulldisclosure/2019/Oct/42	Exploit Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2020/Jan/50	Exploit Mailing List Third Party Advisory
5	https://seclists.org/bugtraq/2019/Oct/30	Exploit Mailing List Third Party Advisory
6	https://seclists.org/bugtraq/2020/Jan/55	Exploit Mailing List Third Party Advisory
7	https://success.trendmicro.com/solution/000149878	Vendor Advisory
8	http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-%28ATTK%29-REMOTE-CODE-EXECUTION.txt
9	https://success.trendmicro.com/solution/000149878	Vendor Advisory
10	https://seclists.org/bugtraq/2020/Jan/55	Exploit Mailing List Third Party Advisory
11	https://seclists.org/bugtraq/2019/Oct/30	Exploit Mailing List Third Party Advisory
12	http://seclists.org/fulldisclosure/2020/Jan/50	Exploit Mailing List Third Party Advisory
13	http://seclists.org/fulldisclosure/2019/Oct/42	Exploit Mailing List Third Party Advisory
14	http://packetstormsecurity.com/files/156160/TrendMicro-Anti-Threat-Toolkit-Improper-Fix.html	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-427	制御されていない検索パスの要素	https://cwe.mitre.org/data/definitions/427.html

JVN Vulnerability Information

Trend Micro Anti-Threat Toolkit における入力確認に関する脆弱性

Title	Trend Micro Anti-Threat Toolkit における入力確認に関する脆弱性
Summary	Trend Micro Anti-Threat Toolkit (ATTK) には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 18, 2019, midnight
Registration Date	Oct. 28, 2019, 6:50 p.m.
Last Update	Nov. 12, 2019, 10:05 a.m.

Affected System

トレンドマイクロ

Anti-Threat Toolkit 1.62.0.1218 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-9491	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9491
National Vulnerability Database (NVD)
2	CVE-2019-9491	https://nvd.nist.gov/vuln/detail/CVE-2019-9491

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
TrendMicro Solution
1	000149878	https://success.trendmicro.com/solution/000149878

その他

No	Name	URL
JVN
1	JVNVU#91935870	https://jvn.jp/vu/JVNVU91935870/

Change Log

No	Changed Details	Date of change
1	[2019年10月28日] 掲載	Oct. 28, 2019, 6:50 p.m.
2	[2019年11月12日] 参考情報：JVN (JVNVU#91935870) を追加	Nov. 12, 2019, 9:51 a.m.