Microsoft Security Advisory (2491888)

The following table provides an exploitability assessment of the vulnerability addressed in this advisory.

How do I use this table?

Use this table to learn about the likelihood of functioning exploit code being released within 30 days of this advisory release. You should review the assessment below, in accordance with your specific configuration, in order to prioritize your deployment. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.

Why was this advisory revised on March 8, 2011? 
When this advisory was first released, an updated version of the Malicious Software Removal Tool (MSRT) was not available. Microsoft released an updated version of the MSRT on Tuesday, March 8, 2011 that addresses the vulnerability. Versions of the MSRT released on or after that date are not affected by the vulnerability described in this security advisory.

Why was no update for the Malicious Software Removal Tool (MSRT) available when this Security Advisory was first released? 
The vulnerability could only be exploited through February 2011 or earlier versions of the MSRT when the MSRT was initially offered and downloaded using Automatic Updates. Microsoft released an updated version to address the issue in the Malicious Software Removal Tool on Tuesday, March 8, 2011. Versions of the MSRT released on or after that date are not vulnerable to the issue described in this security advisory.

MSRT runs only once when downloaded using Automatic Updates. An attacker could not exploit this vulnerability by running a vulnerable version of the MSRT manually.

Is Microsoft releasing a Security Bulletin to address this vulnerability? 
No. Microsoft is releasing this informational security advisory to help ensure customers are aware that this Microsoft Malware Protection Engine update also addresses a security vulnerability reported to Microsoft.

Typically, no action is required of enterprise administrators or end users to install this update.

Why is typically no action required to install this update? 
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, anti-malware software must be kept up to date with these updates in a timely manner.

For enterprise deployments as well as end users, the default configuration in Microsoft anti-malware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.

Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.

How often are the Microsoft Malware Protection Engine and malware definitions updated? 
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.

Depending on which Microsoft anti-malware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.

How can I install the update? 
Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.

For more information on installing the latest definitions, visit the Microsoft Malware Protection Center, or refer to your product documentation.

For end users, no further action is required because this security update will be downloaded and installed automatically through automatic updating or through their anti-malware software. For information on how to configure anti-malware software, refer to your product documentation.

For end users who want to install this update manually, refer to the following table.

Note Updates available through Microsoft Update will be listed as Important. Look for the appropriate update for your software with a name similar to the example listed in parenthesis () in the table below.

Note For additional information about deployment of this update for specific Microsoft anti-malware products, refer to Microsoft Knowledge Base Article 2510781.

What is the Microsoft Malware Protection Engine? 
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software. For more information, see the section, Microsoft Malware Protection Engine Deployment, later in this advisory.

Where can I find more information about Microsoft anti-malware technology? 
For more information, visit the Microsoft Malware Protection Center Web site.

Why is ISA Server not listed in the affected or non-affected software list? 
While Microsoft Internet Security and Acceleration (ISA) Server is the predecessor of Forefront Threat Management Gateway 2010 (TMG), ISA Server does not contain the Microsoft Malware Protection Engine and as such is not considered in this advisory. Malware Scanning using the Microsoft Malware Protection Engine was first introduced in Forefront TMG. For more information about new features in Forefront TMG, see the Forefront Threat Management Gateway 2010 page, What's New.

What is the scope of the vulnerability? 
This is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What causes the vulnerability? 
The vulnerability is caused when the Microsoft Malware Protection Engine fails to properly process a registry key that an attacker has set to a specially crafted value.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take complete control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What is the LocalSystem account? 
The LocalSystem account is a predefined local account used by the service control manager. It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. A service that runs in the context of the LocalSystem account inherits the security context of the Service Control Manager. Most services do not need such a high privilege level. For more information, see the MSDN article, LocalSystem Account.

How could an attacker exploit the vulnerability? 
This vulnerability requires that a specially crafted registry location be scanned by an affected version of the Microsoft Malware Protection Engine. To exploit this vulnerability, an attacker would first have to log on to the system, and then set a user registry key to a specially crafted value.

If the affected anti-malware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan the location automatically, leading to exploitation of the vulnerability and allowing the attacker to take complete control of the affected system. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited and to take complete control of the affected system. An attacker could not exploit the vulnerability by initiating a scan manually.

In addition, exploitation of the vulnerability could occur when the system is scanned using an affected version of the Malicious Software Removal Tool (MSRT). However, if the current version of the MSRT has already run on the system, an attacker could not use the MSRT to exploit this vulnerability.

What systems are primarily at risk from the vulnerability? 
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative permissions are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.

What does the update do? 
The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine processes values read from the registry.

When this security advisory was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security advisory was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued.