Microsoft plugs crazy bad bug with emergency patch

On Monday night, Microsoft released a critical out-of-band security update for the Microsoft Malware Protection Engine, to plug an easily exploitable bug that could allow remote attackers to compromise target Windows machines.

The vulnerability (CVE-2017-0290)

The vulnerability can be exploited to execute arbitrary code in the security context of the LocalSystem account. This would allow attackers to take control of the target system, install programs, view, change, or delete data, create new accounts with full user rights, and so on.

“To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine.” Microsoft explained in an advisory accompanying the security update.

“There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim’s system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.”

Who’s in danger?

The Microsoft Malware Protection Engine powers a number of Microsoft antimalware software:

• Windows Defender for Windows 7, 8.1, RT 8.1, 10, 10 1511, 10 1607, 1703, and Windows Server 2016
• Microsoft Security Essentials
• Windows Intune Endpoint Protection
• Microsoft System Center Endpoint Protection
• Microsoft Endpoint Protection
• Microsoft Forefront Endpoint Protection 2010
• Microsoft Forefront Security for SharePoint Service Pack 3.

If set up to do so, all these installations will receive and implement the security update seamlessly.

“For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating,” the company noted in the advisory.

“Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.”

Is the flaw being exploited in the wild?

The security vulnerability was discovered by Google Project Zero researchers Tavis Ormandy and Natalie Silvanovich, and Microsoft was notified of its existence right away.

Ormandy mentioned the “crazy bad” bug on Friday, and Microsoft began delivering the security update on Monday. It is expected to be rolled out to most machines in the next two days.

The company acknowledged Ormandy’s and Silvanovich’s responsible disclosure, and said that they have “not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued” (on Monday evening).

With more technical details about the vulnerability having been made public, it’s possible that attackers are trying to come up with a working exploit, but it’s unlikely they’ll manage to have something before the security update is pushed on the great majority of machines.