Update Windows Defender immediately: Microsoft has released an silent update for a vulnerability that allowed remote code execution in the Malware Protection Engine used by Windows security software, Windows Defender, which is available by default in Windows 10.
Discovered on May 12 by renowned Google Project Zero security researcher Tavis Ormandy, the flaw existed in the MsMpEng x86 emulator, and could be exploited by attackers with a malicious executable file, mainly because it was not sandboxed.
“MsMpEng includes a full x86 system emulator that is used to execute any untrusted files that look like PE executables. The emulator runs as NT AUTHORITY\SYSTEM and is not sandboxed. Looking through the list of win32 APIs supported by the emulator, I noticed ntdll!NtControlChannel, an ioctl-like routine that allows emulated code to control the emulator,” the security expert explains.
“The 0x0C command allows you to convert an attacker-controlled RegularExpressions to Microsoft GRETA (a library abandoned since the early 2000s) … The 0x12 command allows you to load additional microcode that can replace opcodes … Various commands allow you to change execution parameters and read UFS scan attributes and metadata. This looks like a privacy leak at the very least, as the attacker can look up the search attributes you set and then retrieve them through the scan results.”
Ormandy calls the security flaw a “potentially extremely malicious vulnerability.” The researcher reported this new vulnerability to Microsoft privately, and the company rolled out a fix for Windows Defender last week. To stay protected, you should have automatic updates enabled and be running the latest version of Windows Defender.
Microsoft has not yet issued any official statement on the matter.
