PT-2018-1102 · Microsoft · System Center Endpoint Protection+7
Published
2018-04-03
·
Updated
2021-09-09
·
CVE-2018-0986
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Malware Protection Engine (affected versions not specified)
Windows Defender (affected versions not specified)
Windows Intune Endpoint Protection (affected versions not specified)
Microsoft Security Essentials (affected versions not specified)
Microsoft System Center Endpoint Protection (affected versions not specified)
Microsoft Exchange Server (affected versions not specified)
Microsoft System Center (affected versions not specified)
Microsoft Forefront Endpoint Protection (affected versions not specified)
Description
A remote code execution issue exists due to improper scanning of a specially crafted file by the Microsoft Malware Protection Engine, leading to memory corruption. This can allow a remote attacker to execute arbitrary code with SYSTEM privileges and gain full control over the system using a specially crafted file, such as a rar file. The vulnerability is related to insufficient input validation and a buffer overflow in memory.
Recommendations
For Microsoft Malware Protection Engine, consider restricting the use of the mpengine.dll module until a patch is available.
For Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, and Microsoft Forefront Endpoint Protection, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Exchange Server
Forefront Endpoint Protection
Malware Protection Engine
Security Essentials
System Center
System Center Endpoint Protection
Windows Defender
Windows Intune Endpoint Protection