Critical Vulnerability in Microsoft Malware Protection Engine
Description
A vulnerability was reported in Microsoft Windows Defender. A remote user can cause arbitrary code to be executed on the target user’s system.
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
The Exploit
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.
If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.
An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
All systems running an affected version of antimalware software are primarily at risk, meaning that users and admins should update immediately to avoid attacks. The attack doesn’t need user interaction because the Microsoft Malware Protection Engine automatically scans all incoming files.
Experts pointed out that Windows Defender is enabled by default on Windows 10.
How Did Microsoft Fix CVE-2018-0986?
Microsoft release a patch to fix the above issue. The patch works by correcting the way Microsoft Malware Protection Engine scans specially crafted files.
How can Symantec help?
Symantec Control Compliance Suite Vulnerability Manager helps you scan all systems to identify endpoints where the vulnerable software version is present, along with automating the patching using the Symantec Endpoint Management Suite.
References
- EXPLOIT-DB:44402
- https://www.exploit-db.com/exploits/44402/
- CONFIRM:
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0986
- BID:103593
- http://www.securityfocus.com/bid/103593
- SECTRACK:1040631
- http://www.securitytracker.com/id/1040631