Trend Micro has released new versions of its antivirus and password manager products to address a security issue discovered by Google Project Zero researcher Tavis Ormandy.
According to Mr. Ormandy, in the factory settings, Trend Micro's Maximum Security, Premium Security and Password Manager products open a remote Node.js debugger program and leave it listening for commands on a random localhost port.
Mr. Ormandy also put together an exploit that consisted of loading thousands of images that would probe the local server over a varying number of ports until it revealed the one open for the client.
It would then make JavaScript to that port, executing commands on the user's computer. The exploit, which was cleverly put together, according to Mr. Ormandy, relied on attackers tricking users into accessing a malicious page, which is not that out of the ordinary.
The researcher contacted Trend Micro staff, as he himself had been working on a quick fix for the past week that would detect the vulnerable port – the one that the Node.js debugger would launch for its own services – preventing the debugger from connecting to the port and closing it.
This quick patch was released on March 30th, but Trend Micro has also started working on a permanent solution. However, this will take some time to implement since it is a complex feature.
According to Trend Micro, the source of the vulnerability is in a module that loads a third-party binary. The Trend Micro team says it will have to crack that binary, change its source code to prevent the debugger from starting, and then integrate it into the source code of its applications. The team estimates that this will take about a month.
In January, Mr. Ormandy also discovered that a similar Node.js server was started by Trend Micro's Password Manager revealing user passwords.
