Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution

Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution

Published: May 14, 2013

Version: 1.0

General Information

Executive Summary

Microsoft is releasing this security advisory to help ensure customers are aware that an update to the Microsoft Malware Protection Engine also addresses a security vulnerability reported to Microsoft. The update addresses a vulnerability that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take complete control of the system.

This vulnerability has been publicly disclosed as a denial of service.

The Microsoft Malware Protection Engine is a part of several Microsoft antimalware products. See the Affected Software section for a list of affected products. Updates to the Microsoft Malware Protection Engine are installed along with the updated malware definitions for the affected products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.

Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within the next 48 hours. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.

Mitigating Factors:

  • Only x64-based versions of the Malware Protection Engine are affected.

Advisory Details

Issue References

For more information about this issue, see the following references:

ReferencesIdentification
CVE ReferenceCVE-2013-1346
Last version of the Microsoft Malware Protection Engine affected by this vulnerabilityVersion 1.1.9402.0
First version of the Microsoft Malware Protection Engine with this vulnerability addressedVersion 1.1.9506.0*

*If your version of the Microsoft Malware Protection Engine is equal to or greater than this version, then you are not affected by this vulnerability and do not need to take any further action. For more information on how to verify the engine version number that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.

Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.

The Microsoft Malware Protection Engine is a part of several Microsoft antimalware products. Depending upon which affected Microsoft antimalware product is installed, this update may have different severity ratings. The following severity ratings assume the potential maximum impact of the vulnerability.

Affected Software

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Antimalware SoftwareMicrosoft Malware Protection Engine Vulnerability - CVE-2013-1346
Microsoft Forefront Client Security (x64)Important 
Remote Code Execution
Microsoft Forefront Endpoint Protection 2010 (x64)Important 
Remote Code Execution
Microsoft Forefront Security for SharePoint Service Pack 3 (x64)Important 
Remote Code Execution
Microsoft System Center 2012 Endpoint Protection (x64)Important 
Remote Code Execution
Microsoft System Center 2012 Endpoint Protection Service Pack 1 (x64)Important 
Remote Code Execution
Microsoft Malicious Software Removal Tool (x64)[1]Important 
Remote Code Execution
Microsoft Security Essentials (x64)Important 
Remote Code Execution
Microsoft Security Essentials Prerelease (x64)Important 
Remote Code Execution
Windows Defender for Windows 8 (x64)Important 
Remote Code Execution
Windows Defender for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (x64)Important 
Remote Code Execution
Windows Defender Offline (x64) Important 
Remote Code Execution
Windows Intune Endpoint Protection (x64)Important 
Remote Code Execution

[1]Applies only to April 2013 or earlier versions of the Microsoft Malicious Software Removal Tool.

Non-Affected Software

Antimalware Software
Does not run Malware Protection Engine
Microsoft Forefront Server Security Management Console
Microsoft Internet Security and Acceleration (ISA) Server
Does not run a vulnerable version of Malware Protection Engine
Microsoft Antigen for Exchange
Microsoft Antigen for SMTP Gateway
Microsoft System Center 2012 Endpoint Protection for Linux
Microsoft System Center 2012 Endpoint Protection for Mac
Microsoft Forefront Protection 2010 for Exchange Server
Microsoft Forefront Security for Exchange Server Service Pack 2
Microsoft Forefront Security for Office Communications Server
Microsoft Forefront Threat Management Gateway 2010
Microsoft Forefront Client Security (x86)
Microsoft Forefront Endpoint Protection 2010 (x86)
Microsoft Forefront Security for SharePoint Service Pack 3 (x86)
Microsoft Malicious Software Removal Tool (x86)
Microsoft Security Essentials (x86)
Microsoft Security Essentials Prerelease (x86)
Microsoft System Center 2012 Endpoint Protection (x86)
Microsoft System Center 2012 Endpoint Protection Service Pack 1 (x86)
Microsoft System Center 2012 Endpoint Protection for Mac Service Pack 1
Windows Defender for Windows 8 (x86)
Windows Defender for Windows RT
Windows Defender for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (x86)
Windows Defender Offline (x86) 
Windows Intune Endpoint Protection (x86)

The following table provides an exploitability assessment of the vulnerability addressed in this advisory.

How do I use this table?

Use this table to learn about the likelihood of functioning exploit code being released within 30 days of this advisory release. You should review the assessment below, in accordance with your specific configuration, in order to prioritize your deployment. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.

Vulnerability TitleCVE IDExploitability Assessment for Latest Software ReleaseExploitability Assessment for Older Software ReleaseDenial of Service Exploitability AssessmentKey Notes
Microsoft Malware Protection Engine VulnerabilityCVE-2013-13462 - Exploit code would be difficult to build2 - Exploit code would be difficult to buildTemporaryOnly x64 versions of the Malware Protection Engine are affected.

This vulnerability has been publicly disclosed as a denial of service.

Is Microsoft releasing a Security Bulletin to address this vulnerability? 
No. Microsoft is releasing this informational security advisory to help ensure customers are aware that this Microsoft Malware Protection Engine update also addresses a security vulnerability reported to Microsoft.

Typically, no action is required of enterprise administrators or end users to install this update.

Why is typically no action required to install this update? 
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.

For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.

Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.

How often are the Microsoft Malware Protection Engine and malware definitions updated? 
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.

Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.

How can I install the update? 
Refer to the section, Suggested Actions, for details on how to install this update.

What is the Microsoft Malware Protection Engine? 
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software. For more information, see the section, Microsoft Malware Protection Engine Deployment, later in this advisory.

Where can I find more information about Microsoft antimalware technology? 
For more information, visit the Microsoft Malware Protection Center website.

What is the scope of the vulnerability? 
This is a remote code execution vulnerability.

What causes the vulnerability? 
The vulnerability is caused when the Microsoft Malware Protection Engine does not properly scan a specially crafted file leading to memory corruption.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take complete control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

What is the LocalSystem account? 
The LocalSystem account is a predefined local account used by the service control manager. It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. A service that runs in the context of the LocalSystem account inherits the security context of the Service Control Manager. Most services do not need such a high privilege level. For more information, see the MSDN article, LocalSystem Account.

How could an attacker exploit the vulnerability? 
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.

If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited.

In addition, exploitation of the vulnerability could occur when the system is scanned using an affected version of the Malicious Software Removal Tool (MSRT).

What systems are primarily at risk from the vulnerability? 
Systems running an affected 64-bit version of antimalware software are primarily at risk.

What does the update do? 
The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.

When this security advisory was issued, had this vulnerability been publicly disclosed? 
Yes. This vulnerability has been publicly disclosed as a denial of service. It has been assigned Common Vulnerability and Exposure CVE-2013-1346.

When this security advisory was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued.

Verify the update is installed

Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.

For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.

For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.9506.0 or later.

If necessary, install the update

Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.

For end-users, the affected software provide built-in mechanisms for the automatic detection and deployment of this update. For these customers the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. End users that do not wish to wait can manually update their antimalware software.

For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to Microsoft Knowledge Base Article 2510781.

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Graeme Gill of Argyll CMS for working with us on the Microsoft Malware Protection Engine Vulnerability (CVE-2013-1346)

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Feedback

Support

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (May 14, 2013): Advisory published.

Built at 2014-04-16T02:39:51Z-07:00

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.