Microsoft acts quickly following disclosure by Google’s Project Zero bug-hunters<\/b>
\nMicrosoft issued an emergency patch overnight in order to protect users from a \u2018severe’ remote-code execution flaw affecting Windows’ Malware Protection Engine.
The flaw had been described as \u00ab\u00a0crazy bad\u00a0\u00bb by Tavis Ormondy, a security researcher at Google’s Project Zero, who uncovered the flaw alongside fellow researcher Natalie Silvanovich .
\u00ab\u00a0MsMpEng is the Malware Protection service that is enabled by default on Windows 8,8.1,10, Windows Server 2012, and so on, \u00a0\u00bb wrote Ormondy in a Project Zero advisory over the weekend .
\u00ab\u00a0Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine. MsMpEng runs as NT AUTHORITY\\SYSTEM without sandboxing, and is remotely accessible without authentication via various Windows services, including Exchange, IIS, and so on.
Attackers can access MpEngine simply by sending emails to users (even just reading the email or opening attachments isn’t necessary) , or by visiting links in a web browser, instant messaging and so on, according to Ormondy.
\u00ab\u00a0This level of accessibility is possible because MsMpEng uses a filesystem mini-filter to intercept and inspect all system filesystem activity, so writing controlled contents to anywhere on disk (for example, caches, temporary internet files, downloads – even unconfirmed downloads – attachments, etcetera) is enough to access functionality in mpengine\u2026
\u00ab\u00a0Vulnerabilities in MsMpEng are among the most severe possible in Windows, due to the privilege, accessibility, and ubiquity of the service.\u00a0\u00bb
Normally, Google gives a vendor 90-days’ grace before going public with the details of security flaws – and often, the companies, including Microsoft, still fail to issue appropriate patches. This time, however, Microsoft acted with uncharacteristic haste.
The vulnerability could enable remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file. \u00ab\u00a0An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system, \u00a0\u00bb warns Microsoft in a security advisory .
The flaw affects Microsoft’s anti-malware scanning across the board: Windows Defender on home PCs; Microsoft Security Essentials, also on home PCs; Microsoft Forefront Endpoint Protection; Windows Intune Endpoint Protection; Microsoft System Center Endpoint Protection; Microsoft Forefront Security for SharePoint; and, Microsoft Endpoint Protection – the whole lot.
Happily, perhaps, for systems administrators the update will be rolled out automatically alongside the regular malware definitions update. Home users may need to make sure that the update to Windows Defender is selected among \u2018important updates’ if they do not have Windows Update automatically installing updates.
Join Computing and Forcepoint at 3pm on 18 May for our joint webinar, \u00a0\u00bb Hybrid networks: Securing digital transformation \u00ab\u00a0.
Hybrid networks typically blend traditional MLPS networks with managed broadband and WiFi. They can deliver data where it’s needed, to more devices, flexibly, efficiently and reliably. But, this comes at the price of complexity, and also requires a rethinking of security.
So join Computing and Forcepoint on 18 May where we will look at hybrid networks and alternative approaches to achieve a balance of performance and security: enabling digital transformation to become a reality.<\/p>\n

\n

Similarity rank: 1.1<\/div>\n

Sentiment rank: -0.6<\/div>\n

<\/div>\n<\/div>\n