Major Vulnerability Discovered in Microsoft Malware Protection Engine
Microsoft’s antivirus solutions, including Windows Defender, have recently been exposed as more vulnerable than previously thought, affecting Windows 7, 8.1, 10, and Windows Server 2016. This revelation follows an out-of-band security update released by Microsoft to address a severe remote code execution (RCE) vulnerability discovered by researchers from Google’s Project Zero.
Tavis Ormandy, one of the researchers involved, characterized the flaw as “the worst Windows remote code execution vulnerability in recent memory.” Alongside Natalie Silvanovich, Ormandy developed a proof-of-concept exploit illustrating the vulnerability’s alarming severity. They confirmed that the vulnerability could affect default installations, showcasing “wormable” capabilities—meaning it could self-replicate on an infected machine and propagate to additional systems without user intervention.
According to Microsoft’s advisory, the flaw, identified as CVE-2017-0290, exists within the Microsoft Malware Protection Engine (MMPE), the antivirus engine used in several Microsoft products. This loophole permits remote attacks that could compromise computers without any user interaction, raising significant security concerns for organizations utilizing these products.
The vulnerability is widespread, impacting various anti-malware solutions powered by MMPE, including Windows Defender, Microsoft Security Essentials, and Microsoft Forefront Security for SharePoint. Given the default activation of Microsoft’s Defender on multiple Windows platforms, including Windows 10, all users of these systems are susceptible to potential remote system takeovers.
Investigations revealed that the flaw arises from weaknesses in the way the MMPE scans files. Attackers can create malicious files capable of corrupting system memory. Researchers labeled this issue a “type confusion” vulnerability, linked to the NScript component of the MMPE. This component evaluates filesystem or network behavior that mimics JavaScript, failing to appropriately validate inputs. As a result, the JavaScript interpreter operates with elevated privileges across all modern Windows systems.
The nature of the exploit allows attackers multiple entry points, facilitating access through phishing emails, dubious websites, and instant messaging. Researchers highlight that such attacks can leverage the MMPE’s filesystem minifilter to monitor and analyze all file system activities. Consequently, merely downloading or accessing a contaminated file could trigger the exploit, granting attackers elevated control over the victim’s system.
If successfully executed, the exploit could allow attackers to install malicious software, steal sensitive data, and engage in various cybercriminal activities, compromising organizational security significantly. In response to this critical vulnerability, Microsoft acted swiftly, releasing a patch within three days. The vulnerable version of the MMPE was 1.1.13701.0, and users are encouraged to update to version 1.1.13704.0 promptly. Windows PCs typically install the latest definitions and updates automatically, but users can manually check for the update in their settings if immediate action is necessary.
Organizations utilizing Microsoft’s antivirus products should prioritize this update to mitigate risks associated with this notable vulnerability, which poses a significant threat across multiple Windows platforms. Cybersecurity practitioners are advised to remain vigilant in understanding how such threats align with the MITRE ATT&CK framework, particularly in terms of tactics related to initial access and privilege escalation, which may have been employed during such attacks.