Executive Summary
Summary | |
---|---|
Title | Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of Privilege |
Informations | |||
---|---|---|---|
Name | KB2491888 | First vendor Publication | 2011-02-23 |
Vendor | Microsoft | Last vendor Modification | 2011-03-08 |
Severity (Vendor) | N/A | Revision | 1.1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 7.2 | Attack Range | Local |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Microsoft is releasing this security advisory to help ensure customers are aware that an update to the Microsoft Malware Protection Engine also addresses a security vulnerability reported to Microsoft. The update addresses a privately reported vulnerability that could allow elevation of privilege if the Microsoft Malware Protection Engine scans a system after an attacker with valid logon credentials has created a specially crafted registry key. An attacker who successfully exploited the vulnerability could gain the same user rights as the LocalSystem account. The vulnerability could not be exploited by anonymous users. Since the Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products, the update to the Microsoft Malware Protection Engine is installed along with the updated malware definitions for the affected products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly. Typically, no action is required of enterprise administrators or end users to install this update, because the built-in mechanism for the automatic detection and deployment of this update will apply the update within the next 48 hours. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. For more information about this issue, see the following references: *This version is the last version of the Microsoft Malware Protection Engine that is affected by the vulnerability. **If your version of the Microsoft Malware Protection Engine is equal to or greater than this version, then you are not affected by this vulnerability and do not need to take any further action. For more information on how to verify the engine version number that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781. The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle. The Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products. Depending upon which affected Microsoft anti-malware product is installed, this update may have different severity ratings. The following severity ratings assume the potential maximum impact of the vulnerability. Affected Software [1]Applies only to February 2011 or earlier versions of the Microsoft Malicious Software Removal Tool. Non-Affected Software The following table provides an exploitability assessment of the vulnerability addressed in this advisory. How do I use this table? Use this table to learn about the likelihood of functioning exploit code being released within 30 days of this advisory release. You should review the assessment below, in accordance with your specific configuration, in order to prioritize your deployment. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index. Why was this advisory revised on March 8, 2011? Why was no update for the Malicious Software Removal Tool (MSRT) available when this Security Advisory was first released? Is Microsoft releasing a Security Bulletin to address this vulnerability? Typically, no action is required of enterprise administrators or end users to install this update. Why is typically no action required to install this update? For enterprise deployments as well as end users, the default configuration in Microsoft anti-malware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating. Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment. How often are the Microsoft Malware Protection Engine and malware definitions updated? Depending on which Microsoft anti-malware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time. How can I install the update? For more information on installing the latest definitions, visit the Microsoft Malware Protection Center, or refer to your product documentation. For end users, no further action is required because this security update will be downloaded and installed automatically through automatic updating or through their anti-malware software. For information on how to configure anti-malware software, refer to your product documentation. For end users who want to install this update manually, refer to the following table. Note Updates available through Microsoft Update will be listed as Important. Look for the appropriate update for your software with a name similar to the example listed in parenthesis () in the table below. Note For additional information about deployment of this update for specific Microsoft anti-malware products, refer to Microsoft Knowledge Base Article 2510781. What is the Microsoft Malware Protection Engine? Where can I find more information about Microsoft anti-malware technology? Why is ISA Server not listed in the affected or non-affected software list? What is the scope of the vulnerability? What causes the vulnerability? What might an attacker use the vulnerability to do? What is the LocalSystem account? How could an attacker exploit the vulnerability? If the affected anti-malware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan the location automatically, leading to exploitation of the vulnerability and allowing the attacker to take complete control of the affected system. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited and to take complete control of the affected system. An attacker could not exploit the vulnerability by initiating a scan manually. In addition, exploitation of the vulnerability could occur when the system is scanned using an affected version of the Malicious Software Removal Tool (MSRT). However, if the current version of the MSRT has already run on the system, an attacker could not use the MSRT to exploit this vulnerability. What systems are primarily at risk from the vulnerability? What does the update do? When this security advisory was issued, had this vulnerability been publicly disclosed? When this security advisory was issued, had Microsoft received any reports that this vulnerability was being exploited? Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of this issue. The following mitigating factors may be helpful in your situation: There is typically no action required for enterprise administrators or end users to install this update. Microsoft recommends that customers keep malware definitions up to date at all times. Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft anti-malware products. Administrators of enterprise anti-malware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment. For end-users, the affected software provide built-in mechanisms for the automatic detection and deployment of this update. For these customers the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. End users that do not wish to wait can manually update their anti-malware software. For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to Microsoft Knowledge Base Article 2510781, or refer to the section, Frequently Asked Questions (FAQ) About this Advisory. |
Original Source
Url : http://www.microsoft.com/technet/security/advisory/2491888.mspx |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 | |
Application | 1 | |
Application | 1 | |
Application |
| 5 |
Application | 1 | |
Application | 1 | |
Application | 1 |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
71017 | Microsoft Malware Protection Engine (MMPE) Crafted Registry Key Local Privile... Microsoft Malware Protection Engine contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when an error occurs during scanning, allowing a local attacker to gain LocalSystem privileges via a crafted registry key value. |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Microsoft Malware Protection Engine elevation of privilege attempt RuleID : 18501 - Revision : 9 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-06-18 | Name : The remote host has an antimalware application that is affected by a denial o... File : smb_kb2974294.nasl - Type : ACT_GATHER_INFO |
2013-05-15 | Name : The remote host has an antimalware application that is affected by a code exe... File : smb_kb2846338.nasl - Type : ACT_GATHER_INFO |
2011-02-25 | Name : The remote host has an application that is affected by a local privilege esca... File : smb_kb2491888.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-06-19 13:23:03 |
|
2014-02-17 11:38:38 |
|
2014-01-19 21:29:40 |
|