Gaping flaw in Trend Micro Antivirus could have spilled all your passwords

sincity · January 12, 2016

A critical flaw was discovered in Trend Micro's antivirus product by a Google security researcher last week, although the company has now fixed the vulnerability.

The flaw was discovered by Tavis Ormandy, and affected Trend Micro's Password Manager, a module of the security company's antivirus product.

As PC World reports, apparently this password component is written in JavaScript which Ormandy noted "opens multiple HTTP RPC ports for handling API requests" – and it only took him 30 seconds to spot one which allowed for remote code execution.

After an initial exchange with Trend Micro staff, a temporary fix was produced a day later, which was roundly criticised by Ormandy as ineffectual. He then wrote: "You need to come up with a plan for fixing this right now. Frankly, it also looks like you're exposing all the stored passwords to the internet, but let's worry about that screw up after you get the remote code execution under control."

Ormandy subsequently confirmed that anyone on the net could steal all of a user's passwords, as well as being able to remotely execute code, and said he was "astonished" over the whole affair.

A solution was implemented for the Password Manager product yesterday, released as a mandatory update by the company.

Trend defends

In a blog post, Trend Micro said it has "had a mature vulnerability response for a number of years and we handled these reports within that process." The security firm asserted that it had responded quickly to Ormandy's initial report, and addressed the critical issues within a week, adding: "We are not aware of any active attacks against these vulnerabilities in that time."

Last Friday, Ormandy did also advise Trend Micro to temporarily disable the Password Manager while the fix was worked on, noting that the "worst thing you can do is leave users exposed while you clean this thing up", although that advice wasn't heeded.

Ormandy has previously uncovered major vulnerabilities in security software from Sophos.