Multiple vulnerabilities in Microsoft Malware Protection Engine

1) Improper input validation

EUVDB-ID: #VU6795

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8535

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application and trigger a scan timeout.

Successful exploitation of the vulnerability may allow an attacker to disable anti-malware protection on the system until the affected service is restarted.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8535

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Improper input validation

EUVDB-ID: #VU6796

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8536

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application and trigger a scan timeout.

Successful exploitation of the vulnerability may allow an attacker to disable anti-malware protection on the system until the affected service is restarted.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8536

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Improper input validation

EUVDB-ID: #VU6797

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8537

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application and trigger a scan timeout.

Successful exploitation of the vulnerability may allow an attacker to disable anti-malware protection on the system until the affected service is restarted.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8537

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Memory corruption

EUVDB-ID: #VU6799

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8538

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8538

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Improper input validation

EUVDB-ID: #VU6800

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-8539

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application and trigger a scan timeout.

Successful exploitation of the vulnerability may allow an attacker to disable anti-malware protection on the system until the affected service is restarted.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8539

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Memory corruption

EUVDB-ID: #VU6801

Risk: High

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2017-8540

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8540

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

7) Memory corruption

EUVDB-ID: #VU6802

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8541

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8541

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Improper input validation

EUVDB-ID: #VU6803

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-8542

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing specially crafted files within Microsoft Malware Protection Engine (mpengine.dll). A remote attacker can create a specially crafted file, pass it to the affected application and trigger a scan timeout.

Successful exploitation of the vulnerability may allow an attacker to disable anti-malware protection on the system until the affected service is restarted.

Mitigation

Update Microsoft Malware Protection Engine (mpengine.dll) to version 1.1.13804.0.

Vulnerable software versions

Microsoft Malware Protection Engine: 1.1.13704.0

Windows Defender: for Windows RT 8.1 - for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703

Microsoft Security Essentials: All versions

Microsoft Forefront Endpoint Protection: 2010

Microsoft Endpoint Protection: All versions

Microsoft Exchange Server: 2013 RTM 15.00.0516.032 - 2016 RTM 15.01.0225.042

Windows Intune Endpoint Protection: All versions

CPE2.3

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8542

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2017-8535 CVE-2017-8536 CVE-2017-8537 CVE-2017-8538 CVE-2017-8539 CVE-2017-8540 CVE-2017-8541 CVE-2017-8542
CWE-ID	CWE-20 CWE-119
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #4 is available. Vulnerability #6 is being exploited in the wild. Public exploit code for vulnerability #7 is available.
Vulnerable software	Microsoft Malware Protection Engine Client/Desktop applications / Antivirus software/Personal firewalls Windows Defender Client/Desktop applications / Antivirus software/Personal firewalls Microsoft Security Essentials Client/Desktop applications / Antivirus software/Personal firewalls Microsoft Endpoint Protection Client/Desktop applications / Antivirus software/Personal firewalls Windows Intune Endpoint Protection Client/Desktop applications / Antivirus software/Personal firewalls Microsoft Forefront Endpoint Protection Server applications / DLP, anti-spam, sniffers Microsoft Exchange Server Server applications / Mail servers
Vendor	Microsoft