Windows Defender vulnerability discovered and fixed

Microsoft published the Security Advisory 4022344 yesterday which informs customers about a security vulnerability in the Malware Protection Engine.

The Microsoft Malware Protection Engine is used by various Microsoft products, including Windows Defender and Microsoft Security Essentials on consumer PCs, and products such as Microsoft Endpoint Protection, Microsoft Forefront, Microsoft System Center Endpoint Protection, or Windows Intune Endpoint Protection on the business side.

All products are affected by a critical vulnerability that allows remote code executions if a program that uses the Microsoft Malware Protection Engine scans a crafted file. Attackers may execute arbitrary code on the system if the vulnerability is exploited successfully.

The update addresses a vulnerability that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system.

Windows Defender vulnerability discovered and fixed

Google Project Zero researchers Tavis Ormandy and Natalie Silvanovich discovered what Tavis called the "worst Windows remote code exec in recent memory" on May 6th, 2017. The researchers notified Microsoft about the vulnerability, and kept information hidden from the public to give Microsoft 90 days to fix the vulnerability.

Microsoft managed to create a patch for the vulnerability, and has pushed out new versions of Windows Defender and other Microsoft products already to customers.

Windows customers who have any of the mentioned products installed on their devices need to make sure that it is up to date.

On Windows 10 for instance, you'd do that in the following way:

1. Tap on the Windows-key on the computer keyboard, type Windows Defender, and hit the Enter-key to load the program.
2. If you run Windows 10 Creators Update, you get the new Windows Defender Security Center.
3. Click on the cogwheel icon in the lower left part of the interface.
4. Select About on the next page.

Check the "Engine Version" on the page, and make sure it is at the very least 1.1.13704.0.

Windows Defender updates are available through Windows Update, and Microsoft has published information on how to update the Microsoft Malware Protection Engine on various versions of Windows and in the various products affected by the vulnerability.

The Malware Protection Center on the Microsoft website offers information on updating Microsoft antimalware products manually.

More information on the vulnerability

Google released the vulnerability report on the Project Zero website. This makes it even more pressing to update the engine Microsoft's security programs use as attackers may use the information to craft attacks against computer systems that are still vulnerable.

Vulnerabilities in MsMpEng are among the most severe possible in Windows, due to the privilege, accessibility, and ubiquity of the service.

The core component of MsMpEng responsible for scanning and analysis is called mpengine. Mpengine is a vast and complex attack surface, comprising of handlers for dozens of esoteric archive formats, executable packers and cryptors, full system emulators and interpreters for various architectures and languages, and so on. All of this code is accessible to remote attackers.

NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.

Now You: Which security software do you use on your system, and why?

Advertisement