A significant update for Trend Micro’s Antivirus One software has been released.
The update addresses a critical vulnerability that may have enabled attackers to inject malicious code.
The vulnerability, called custom dynamic library injection vulnerability CVE-2024-34456, may enable an attacker to inject malicious code into the application’s context.
Integrate ANY.RUN in Your Company for Effective Malware Analysis
Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:
- Real-time Detection
- Interactive Malware Analysis
- Easy to Learn by New Security Team members
- Get detailed reports with maximum data
- Set Up Virtual Machine in Linux & all Windows OS Versions
- Interact with Malware Safely
If you want to test all these features now with completely free access to the sandbox:
This particular vulnerability poses a significant risk since it has the ability to breach system security and serve as an entry point for other attacks.
Vulnerability Details
Versions 3.10.3 and below of Trend Micro Antivirus One are vulnerable to a custom dynamic library injection vulnerability (dylib).
If the vulnerability is successfully exploited, attackers may typically be able to bypass security measures, introduce more spyware into the device, and launch subsequent network attacks.
Currently, Trend Micro has not been notified of any actual attacks against the impacted products about this issue.
Raffaele Sabato, a security researcher, appropriately reported the problem to Trend Micro.
Affected Version(s)
The vulnerability affected Antivirus One for Mac versions 3.10.3 and lower.
Fix Available
Version 3.10.4 of Trend Micro’s Antivirus One for Mac has been released, fixing this issue.
Therefore, the business strongly recommends that Mac users who are currently using Trend Micro Antivirus One get this update immediately.
Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide