Windows 10: Security Update for Microsoft Malware Protection Engine

Discus and support Security Update for Microsoft Malware Protection Engine in Windows 10 News to solve the problem; Tweet — Twitter API (@user) date[/quote] Microsoft Security Advisory 4022344 Security Update for Microsoft Malware Protection Engine... Discussion in 'Windows 10 News' started by Brink, May 8, 2017.

Page 1 of 2

Brink New Member
Security Update for Microsoft Malware Protection Engine
Tweet

— Twitter API (@user) date[/quote]

Microsoft Security Advisory 4022344

Security Update for Microsoft Malware Protection Engine
Published: May 8, 2017
Version: 1.0

Executive Summary

Microsoft is releasing this security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft.

The update addresses a vulnerability that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system.

The Microsoft Malware Protection Engine ships with several Microsoft antimalware products. See the Affected Software section for a list of affected products. Updates to the Microsoft Malware Protection Engine are installed along with the updated malware definitions for the affected products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.

Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration...

Advisory Details

Issue References

For more information about this issue, see the following references:

References Identification Last version of the Microsoft Malware Protection Engine affected by this vulnerability Version 1.1.13701.0 First version of the Microsoft Malware Protection Engine with this vulnerability addressed Version 1.1.13704.0
*If your version of the Microsoft Malware Protection Engine is equal to or greater than this version, then you are not affected by this vulnerability and do not need to take any further action. For more information on how to verify the engine version number that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.

Affected Software

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Antimalware Software Microsoft Malware Protection Engine Remote Code Execution Vulnerability- CVE-2017-0290 Microsoft Forefront Endpoint Protection 2010 Critical
Remote Code Execution Microsoft Endpoint Protection Critical
Remote Code Execution Microsoft Forefront Security for SharePoint Service Pack 3 Critical
Remote Code Execution Microsoft System Center Endpoint Protection Critical
Remote Code Execution Microsoft Security Essentials Critical
Remote Code Execution Windows Defender for Windows 7 Critical
Remote Code Execution Windows Defender for Windows 8.1 Critical
Remote Code Execution Windows Defender for Windows RT 8.1 Critical
Remote Code Execution Windows Defender for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703 Critical
Remote Code Execution Windows Intune Endpoint Protection Critical
Remote Code Execution
Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

How do I use this table?

Use this table to learn about the likelihood of code execution and denial of service exploits within 30 days of security bulletin release, for each of the security updates that you may need to install. Review each of the assessments below, in accordance with your specific configuration, to prioritize your deployment of this month's updates. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.

In the columns below, "Latest Software Release" refers to the subject software, and "Older Software Releases" refers to all older, supported releases of the subject software, as listed in the "Affected Software" and "Non-Affected Software" tables in the bulletin.

CVE ID Vulnerability Title Exploitability Assessment for
Latest Software Release Exploitability Assessment for
Older Software Release Denial of Service
Exploitability Assessment CVE-2017-0290 Scripting Engine Memory Corruption Vulnerability 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not applicable
Advisory FAQ

Is Microsoft releasing a Security Bulletin to address this vulnerability?
No. Microsoft is releasing this informational security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft.

Typically, no action is required of enterprise administrators or end users to install this update.

Why is no action required to install this update?
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.

For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.

Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.

How often are the Microsoft Malware Protection Engine and malware definitions updated?
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.

Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.

How can I install the update?
Refer to the section, Suggested Actions, for details on how to install this update.

What is the Microsoft Malware Protection Engine?
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.

Does this update contain any additional security-related changes to functionality?
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.

Where can I find more information about Microsoft antimalware technology?
For more information, visit the Microsoft Malware Protection Center website.

Microsoft Malware Protection Engine Remote Code Execution Vulnerability - CVE-2017-0290

A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file leading to memory corruption.

An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.

If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.

The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued.

Suggested Actions

Verify that the update is installed
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.

For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.

For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.

If necessary, install the update
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.

For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. End users that do not wish to wait can manually update their antimalware software.

For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to Microsoft Knowledge Base Article 2510781.

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

Natalie Silvanovich and Tavis Ormandy of Google Project Zero

Other Information

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Feedback

You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Support

Customers in the United States and Canada can receive technical support from Security Support. For more information, see Microsoft Help and Support.

International customers can receive support from their local Microsoft subsidiaries. For more information, see International Support.

Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

V1.0 (May 8, 2017): Advisory published.

Click to expand...
Brink, May 8, 2017

#1
F14TOMCAT

f14tomcat Win User

Just as a reference, this is as of 10:00am today. Go to Update and Security and open Windows Defender.

Windows 10 - 15063.250

:)

f14tomcat, May 8, 2017

#2
ROB KOCH

Rob Koch Win User

Wannacry - how to check if my Windows 10 1607 64 bit system is protected

I now understand how you combined them, but that's where the problem lies, since the patch released in March was the one I referenced in my post above for SMBv1, MS17-010.

The separate comment from Microsoft regarding Windows Defender is simply referencing the fact that a definition for the Wanna Cry/Wanna Crypt malware had been released as well and has nothing to do with the March Update.

The May 8th release of an urgent replacement to the Microsoft Anti-malware Engine had nothing to do with either of these, so I'd need to see that Fox article to see if that added to the confusion, which is quite possible with so many mostly unrelated, coincidental
events in the same week.

Microsoft Security Advisory 4022344 - Security Update for Microsoft Malware Protection Engine

Rob

Rob Koch, May 8, 2017

#3
ROB KOCH

Rob Koch Win User

Security Update for Microsoft Malware Protection Engine

Wannacry - how to check if my Windows 10 1607 64 bit system is protected

I'm not sure which you mean by the May update, but this may be contributing to your confusion and very possibly that in the Fox News live report as well, since such media reports are often riddled with inaccuracies relating to technical situations such as
malware attacks.

Since the Microsoft Anti-malware engine and definition updates are both shipped in the same large package whenever the engine is updated, for some the difference between these may be blurred. The engines are typically only released once every one or two
months, while new definitions packs are often released over a dozen times a day.

As for the engine security update, this provided a fix for the entirely separate issue covered in that advisory.

So neither of the anti-malware updates did anything to improve the situation regarding this vulnerability, and only the Wanna Cry definition released since Friday would have had anything to do with improving the ability for Defender or any other Microsoft
security client app to detect and block the malware itself. This would have been a possible aid to those who for whatever reason had not installed the March MS17-010 patch, since it might at least have stopped the actual malware attack from succeeding in the
worst case scenario that it was encountered.

Rob

< EDIT > As I stated from the beginning Bruce, the issue with your initial post had nothing to do with the basic facts, it's the implication you create in your first sentence below that the patch in March had anything to do with Windows Defender, which it
didn't. In fact, if the SMBv1 patch had been installed, then neither Windows Defender nor any other security program was even necessary to provide protection from this specific malware, since the updated patch itself would have blocked it fully.

"Microsoft released a patch in March to protect this from happening when using Windows Defender in Windows 8.1 & 10. Most that were affected were using another version or security program. If you have all available
updates installed, then the patch was installed regardless of when you updated."

So maybe rather than being confused by the various unrelated updates I've referenced, you simply didn't write that sentence well and/or keep the concept of anti-malware protection separate from the issue of the original SMBv1 patch. Regardless, the result
is an inaccurate representation of what actually occurred or was required to provide the actual protection to prevent a Wanna Cry infection.

Rob Koch, May 8, 2017

#4
WILEY COYOTE

Wiley Coyote Win User

I just ran an update. You have a later Antimalware version than me. All else is the same. Must be you are on 10 Pro.

Wiley Coyote, May 8, 2017

#5
F14TOMCAT

f14tomcat Win User

I just ran an update. You have a later Antimalware version than me. All else is the same. Must be you are on 10 Pro.
Click to expand...

Clayton,

That's why I posted 15063.250 at the top. If you hold down the windows key and press R (Win key+R) and type WINVER, you will see the version you're on, which should match what's shown on the defender screen.

f14tomcat, May 8, 2017

#6
BREE

Bree New Member

I just ran an update. You have a later Antimalware version than me. All else is the same. Must be you are on 10 Pro.
Click to expand...

No, I'm on Windows 10 Home version 1703, os build 15063.250 and it too shows Engine version: 1.1.13704.0 - the version which has this vulnerability addressed.

From the Advisory...

For more information about this issue, see the following references:
References Identification Last version of the Microsoft Malware Protection Engine affected by this vulnerability Version 1.1.13701.0 First version of the Microsoft Malware Protection Engine with this vulnerability addressed Version 1.1.13704.0
Click to expand...

Bree, May 8, 2017

#7
WILEY COYOTE

Wiley Coyote Win User

Security Update for Microsoft Malware Protection Engine

AH, CU Update 1703. I'm still waiting for Windows Update to take me there. Not that I'm in any hurry.

Wiley Coyote, May 8, 2017

#8
F14TOMCAT

f14tomcat Win User

No, I'm on Windows 10 Home version 1703, os build 15063.250 and it too shows Engine version: 1.1.13704.0 - the version which has this vulnerability addressed.

From the Advisory...
Click to expand...

Think he was confused by the Antimalware vs Engine versions. He probably show Antimalware as 14393.

f14tomcat, May 8, 2017

#9
BREE

Bree New Member

AH, CU Update 1703. I'm still waiting for Windows Update to take me there. Not that I'm in any hurry.
Click to expand...

My Anniversary Update system, 10 Pro version 1607, 14393.1066 also has the 1.1.13704.0 engine.

Bree, May 8, 2017

#10
WILEY COYOTE

Wiley Coyote Win User

Wiley Coyote, May 8, 2017

#11
F14TOMCAT

f14tomcat Win User

Click to expand...

Clayton, you're fine. All is where it should be.

f14tomcat, May 8, 2017

#12
TAIRIKUOKAMI

TairikuOkami Win User

Security Update for Microsoft Malware Protection Engine

Question for people, who use third party AV, which disable WD, has the engine updated as well?!

TairikuOkami, May 8, 2017

#13
DSKILLER

dskiller Win User

for more the engine version for defender is 1.1.13802...

anyway I use avira so, wasnt even worried.

dskiller, May 9, 2017

#14
MIKEMECANIC

MikeMecanic Win User

For RS1: 05-10-'17-6:30AM
Home Edition
Antimalware Client Version: 4.10.14393.1198
Engine Version: 1.1.13704.0
Antivirus definition: 1.243.110.0
Antispyware definition: 1.243.110.0
Network Inspection System Engine Version: 2.1.12706.0
Network Inspection System Definition Version: 116.88.0.0

For RS2:
Pro Edition is the same except: Antimalware Client Version is: 4.11.15063.0

MikeMecanic, May 9, 2017

#15

(You must log in or sign up to reply here.)

Page 1 of 2

Thema:

Security Update for Microsoft Malware Protection Engine

Loading...

Security Update for Microsoft Malware Protection Engine - Similar Threads - Security Update Microsoft
Malware protection
in Windows 10 Gaming
Malware protection: Which is the best antimalware program for windows 11 https://answers.microsoft.com/en-us/windows/forum/all/malware-protection/c3142fce-66ae-42e7-bd5a-5ee4a13912de
Malware protection
in Windows 10 Software and Apps
Malware protection: Which is the best antimalware program for windows 11 https://answers.microsoft.com/en-us/windows/forum/all/malware-protection/c3142fce-66ae-42e7-bd5a-5ee4a13912de
virus protection and threat protection is saying "engine unavailable"
in AntiVirus, Firewalls and System Security
virus protection and threat protection is saying "engine unavailable": when trying to update "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 Version 1.363.104.0" is not updating or installing it, im afraid that im open to virus's and malware because of this...
Microsoft Malware Protection Command Line Utility
in Windows 10 Ask Insider
Microsoft Malware Protection Command Line Utility: There are 51 of these running in task manager. How do I disable them?? It's insane it's using up 75% of my memory. I saw some people say they changed the name of MpCmdRun.exe but when I try that it says I require permission from the same administrator account that I'm trying...
Malware Protection
in AntiVirus, Firewalls and System Security
Malware Protection: What is the best Free Malware to download. https://answers.microsoft.com/en-us/windows/forum/all/malware-protection/020224cb-78a2-4821-9758-5a8efc88ba2e"
Looking for free malware protection that works well with Microsoft
in AntiVirus, Firewalls and System Security
Looking for free malware protection that works well with Microsoft: The last malware protection I has slowed down my computer a lot, and felt a bit like a virus itself. I know free may not be the best way to go for something so important, but wanted to check before I invest in anything. Has anyone had a good experience with a free option?...
How to find the version of the Microsoft Malware Protection Engine
in AntiVirus, Firewalls and System Security
How to find the version of the Microsoft Malware Protection Engine: We used to be able to see the versions of the important WD files in the Security Centre. In Windows 10 1809, build 17763.316, I can't find them anywhere. It's probably too much to expect that the ubiquitous file MsMpEng.exe is the Microsoft Malware Protection Engine,...
Virus and malware protection
in AntiVirus, Firewalls and System Security
Virus and malware protection: Hi, I'm Jose Javier and I have a Window laptop with Windows 10 Home; version 10.0.17763. My computer has Window Defender Security System and an Antivirus named Avast. I have bought my laptop a year ago. I really want to know how I can get total Window Security with Window...
CVE-2018-0986 | Microsoft Malware Protection Engine Vulnerability
in Windows 10 News
CVE-2018-0986 | Microsoft Malware Protection Engine Vulnerability: A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security...

Users found this page by searching for:

data execution prevention windows 10

Log in or Sign up

Search