CVE-2019-14688
📋 TL;DR
This CVE describes a DLL hijack vulnerability in Trend Micro product installers that allows attackers to execute arbitrary code during initial product installation. The vulnerability requires an authorized user to run the installer while malicious DLLs are present locally. Only users performing new installations of affected Trend Micro products are impacted.
💻 Affected Systems
- Trend Micro OfficeScan
- Trend Micro Worry-Free Business Security
- Trend Micro Apex One
📦 What is this software?
Control Manager by Trendmicro
Endpoint Sensor by Trendmicro
Im Security by Trendmicro
Mobile Security by Trendmicro
Officescan by Trendmicro
Scanmail by Trendmicro
Security by Trendmicro
Serverprotect by Trendmicro
Serverprotect by Trendmicro
Serverprotect by Trendmicro
Serverprotect by Trendmicro
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges if malicious DLL executes with installer permissions
Likely Case
Limited impact due to requirement for user interaction during installation and local malicious DLL presence
If Mitigated
No impact if installations are performed from trusted sources with proper file integrity checks
🎯 Exploit Status
Requires social engineering to place malicious DLL and convince user to run installer
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Repackaged installers released by Trend Micro
Vendor Advisory: https://success.trendmicro.com/solution/1123562
Restart Required: No
Instructions:
1. Download updated installers from Trend Micro support portal. 2. Use only repackaged installers for new installations. 3. Existing installations are not affected.
🔧 Temporary Workarounds
Restrict installer execution
windowsLimit who can run installers and from which locations
Verify installer integrity
windowsCheck digital signatures and hashes before running installers
Get-AuthenticodeSignature -FilePath 'installer.exe'
🧯 If You Can't Patch
- Only install from trusted, verified sources with proper file integrity checks
- Implement application whitelisting to prevent unauthorized installer execution
🔍 How to Verify
Check if Vulnerable:
Check if using original vulnerable installers by comparing file hashes with Trend Micro's advisoryCheck Version:
Check installer properties or Trend Micro product documentation for version informationVerify Fix Applied:
Verify using repackaged installers from Trend Micro support portal with updated version numbers📡 Detection & Monitoring
Log Indicators:
- Unusual process creation during installation
- DLL loading from unexpected locations
Network Indicators:
- Downloads of installers from untrusted sources
SIEM Query:
Process creation where parent process is installer and DLL loaded from user-writable location