Executable installers are vulnerable^WEVIL (case 16): Trend Micro's installers allows arbitrary (remote) code execution

Posted by Stefan Kanthak on Dec 31

Hi @ll,

TrendMicro_MAX_10.0_US-en_Downloader.exe (available from
<http://trial.trendmicro.com/US/TM/2016/TrendMicro_MAX_10.0_US-en_Downloader.exe>)
loads and executes ProfAPI.dll and UXTheme.dll (and other DLLs
too) eventually found in the directory it is started from
(the “application directory”).

For software downloaded with a web browser the application
directory is typically the user’s “Downloads” directory:…

Leave a Reply