PT-2017-12319 · Microsoft · Windows Server 2016+9
Published
2017-12-08
·
Updated
2018-10-30
·
CVE-2017-11940
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Malware Protection Engine versions prior to the fixed version
Microsoft Forefront (affected versions not specified)
Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, 1709
Microsoft Exchange Server 2013 and 2016
Windows Server 2016, Windows Server, version 1709
Description
The issue arises from the Microsoft Malware Protection Engine's failure to properly scan a specially crafted file, leading to remote code execution. This allows an attacker to execute arbitrary code on the affected system.
Recommendations
For Microsoft Malware Protection Engine, update to a version that includes the fix for this issue.
For Microsoft Forefront, apply the recommended configuration changes to mitigate the risk of exploitation.
For Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, 1709, ensure the Microsoft Malware Protection Engine is updated to a version that includes the fix.
For Microsoft Exchange Server 2013 and 2016, restrict access to specially crafted files until the issue is resolved.
For Windows Server 2016, Windows Server, version 1709, apply the necessary security updates to address the issue.
Fix
RCE
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Defender
Exchange Server
Forefront
Malware Protection Engine
Windows 10
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Server
Windows Server 2016