CVE-2024-34456: Trend Micro Patches Code Injection Vulnerability in Antivirus One
Trend Micro, a leading provider of cybersecurity solutions, has released an important update for its Antivirus One software, targeting a critical vulnerability that could have allowed attackers to inject malicious code. The issue tracked as CVE-2024-34456 specifically affects the Macintosh platform.
Image: TrendMicro
Details of the Vulnerability
The CVE-2024-34456 vulnerability in question allowed for the injection of a custom dynamic library (dylib) into the Antivirus One application. By exploiting this flaw, an attacker could execute malicious code within the application’s context, potentially compromising the security of the system. This type of vulnerability is particularly concerning because it exploits the very tools users rely on to protect their systems, turning them into potential gateways for further attacks.
This vulnerability poses a significant risk, as successful exploitation could allow attackers to:
- Hijack the antivirus software to disable its protection mechanisms
- Install additional malware on the compromised system
- Steal sensitive data
- Carry out further attacks on the network
Affected Versions
The flaw impacted all versions of Antivirus One for Mac up to version 3.10.3. Users of these versions are advised to update their software immediately to avoid potential security risks.
Patch Available, Users Urged To Update
Trend Micro has released Antivirus One version 3.10.4 for Mac, which addresses this vulnerability. Mac users running Trend Micro Antivirus One are strongly advised to install this update immediately.
The company has confirmed that there are no known instances of attacks exploiting this vulnerability in the wild. The issue was responsibly disclosed to Trend Micro by security researcher Raffaele Sabato.
