jvndb-2020-000064
Vulnerability from jvndb
Published
2020-09-23 15:26
Modified
2020-09-23 15:26
Severity ?
5.9 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Multiple vulnerabilities in Active Update function implemented in multiple Trend Micro products
Details
Active Update function implemented in Premium Security 2019 for Windows (v15), Maximum Security 2019 for Windows (v15), Internet Security 2019 for Windows (v15) and Antivirus+ 2019 for Windows (v15) provided by Trend Micro Incorporated contain multiple vulnerabilities listed below. * Update files are not properly verified (CWE-494) - CVE-2020-15604 * Improper server certificate verification in the communication with the update server (CWE-295) - CVE-2020-24560 Satoshi Mimura of IERAE SECURITY INC. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
JVN https://jvn.jp/en/jp/JVN60093979/index.html
CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15604
CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24560
NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15604
NVD https://nvd.nist.gov/vuln/detail/CVE-2020-24560
No Mapping(CWE-Other) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
Trend Micro, Inc.Antivirus + Security 2019
Trend Micro, Inc.Internet Security 2019
Trend Micro, Inc.Trend Micro Maximum Security 2019
Trend Micro, Inc.Trend Micro Premium Security 2019
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000064.html",
  "dc:date": "2020-09-23T15:26+09:00",
  "dcterms:issued": "2020-09-23T15:26+09:00",
  "dcterms:modified": "2020-09-23T15:26+09:00",
  "description": "Active Update function implemented in Premium Security 2019 for Windows (v15), Maximum Security 2019 for Windows (v15), Internet Security 2019 for Windows (v15) and Antivirus+ 2019 for Windows (v15) provided by Trend Micro Incorporated contain multiple vulnerabilities listed below.\r\n* Update files are not properly verified (CWE-494) - CVE-2020-15604\r\n* Improper server certificate verification in the communication with the update server (CWE-295) - CVE-2020-24560\r\n\r\nSatoshi Mimura of IERAE SECURITY INC. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000064.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:trendmicro:antivirus_%2b_security_2019",
      "@product": "Antivirus + Security 2019",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:internet_security_2019",
      "@product": "Internet Security 2019",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:maximum_security_2019",
      "@product": "Trend Micro Maximum Security 2019",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:premium_security_2019",
      "@product": "Trend Micro Premium Security 2019",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:C/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.9",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000064",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN60093979/index.html",
      "@id": "JVN#60093979",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15604",
      "@id": "CVE-2020-15604",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24560",
      "@id": "CVE-2020-24560",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-15604",
      "@id": "CVE-2020-15604",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-24560",
      "@id": "CVE-2020-24560",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in Active Update function implemented in multiple Trend Micro products"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.