Microsoft's 'Malware Protection Engine' Had A Remote Code Execution Flaw (theregister.co.uk)

Slashdot reader Trax3001BBS shares an article from The Register: Microsoft posted an out-of-band security update Thursday to address a remote code execution flaw in its Malware Protection Engine. Redmond says the flaw, dubbed CVE-2017-11937, has not yet been exploited in the wild. Because it is an out-of-band critical fix, however, it should be installed as soon as possible. For most users, this will happen automatically.

The security hole is present in Windows Defender and Microsoft Security Essentials, as well as Endpoint Protection, Forefront Endpoint Protection, and Exchange Server 2013 and 2016... According to Microsoft, the vulnerability can be triggered when the Malware Protection Engine scans a downloaded file to check for threats. In many systems this is set to happen automatically for all new files. By exploiting a memory corruption error in the malware scanning tool, the attack file would be able to execute code on the target machine with LocalSystem privileges.

Comments

Re: I got a Mac instead of a Win10 laptop

[Zero__Kelvin]

You should be careful where you get your news. That article says Microsoft was "leading the pack" even though OpenBSD had the fix months earlier because Theodore the rat violated the agreement for all vendors to wait and fix it at the same time. Linux also already had a fix. Google and Apple both had fixes as well; they just hadn't rolled them out to every device yet. If you know anything about Android you know it is outside of Google's control, just as the Linux team can't force every distro to roll out a patch. Again, "Microsoft is leading the pack here" is a bald faced lie.