Threat Outbreak Alert RuleID28978: Email Messages Distributing Malicious Software on May 16, 2017

Medium Alert ID: 53852 First Published: 2017 May 16 14:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28978 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID29140: Email Messages Distributing Malicious Software on May 16, 2017

Medium Alert ID: 53850 First Published: 2017 May 16 14:12 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29140 may contain the following files: Name | Size...

Microsoft Malware Protection Engine RCE (CVE-2017-0290)

Natalie Silvanovich and Tavis Ormandy of Google Project Zero found a pretty nasty bug in Microsoft Malware Protection Engine, allowing an attacker to execute arbitrary code as LocalSystem on any Windows computer running any Microsoft anti-malware product such as Security Essentials or Windows...

Threat Outbreak Alert RuleID29094: Email Messages Distributing Malicious Software on May 12, 2017

Medium Alert ID: 53816 First Published: 2017 May 13 02:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29094 may contain the following files: Name | Size...

On the Microsoft Malware Protection RCE, Handbrake, and Trump's EO

Mike Mimoso and Chris Brook discuss the news of the week, including Tavis Ormandy and Natalie Silvanovich’s Microsoft Malware Protection Engine bug, Handbrake OS X malware, the HP keylogger, Trump’s Cybersecurity EO, and more. Download: ThreatpostNewsWrapMay122017.mp3 Music by Chris Gonsalves...

Threat Outbreak Alert RuleID29054: Email Messages Distributing Malicious Software on May 10, 2017

Medium Alert ID: 53787 First Published: 2017 May 10 18:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29054 may contain the following files: Name | Size...

Microsoft Malware Protection Engine RCE Vulnerability (4022344)

This host is missing an important security update according to Microsoft Security Advisory 4022344. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Threat Outbreak Alert RuleID29073: Email Messages Distributing Malicious Software on May 9, 2017

Medium Alert ID: 53779 First Published: 2017 May 9 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29073 may contain the following files: Name | Size ...

Threat Outbreak Alert RuleID29067: Email Messages Distributing Malicious Software on May 9, 2017

Medium Alert ID: 53777 First Published: 2017 May 9 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29067 may contain the following files: Name | Size ...

Microsoft Fixes Malware Protection Engine and Several 0-Day Vulnerabilities, and Deprecates SHA-1

Hours before today’s Patch Tuesday release on the eve of May 8, Microsoft released an emergency updated to fix a vulnerability in their Malware Protection Engine. This critical vulnerability allows an attacker to take complete control of the victim's machine by just sending an e-mail attachment...

Remote code execution

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

CVE-2017-0290

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

CVE-2017-0290

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

CVE-2017-0290

CVE-2017-0290 affects the Microsoft Malware Protection Engine (mpengine) used by Forefront/Defender on Windows clients/servers. The flaw is a memory corruption vulnerability triggered when scanning a specially crafted file, enabling remote code execution. Affected products span Windows 7/8.1/10 a...

CVE-2017-0290

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

Microsoft Malware Protection Engine Remote Code Execution Vulnerability

The Microsoft Malware Protection Engine mpengine.dll provides scanning, monitoring and removal capabilities for antivirus and anti-spyware clients. A remote code execution vulnerability exists in Microsoft Malware Protection Engine. The remote code execution vulnerability can be triggered when...

CVE-2017-0290: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

KLA11029 Multiple vulnerabilities in the Microsoft Malware Protection Engine

Multiple serious vulnerabilities have been found in Microsoft Malware Protection Engine. Malicious users can exploit these vulnerabilities to cause a denial of service and execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities related to an improper...

MS Security Advisory 4022344: Security Update for Microsoft Malware Protection Engine

The version of Microsoft Malware Protection Engine MMPE installed on the remote Windows host is prior to 1.1.13704.0. It is, therefore, affected by a remote code execution vulnerability in the NScript component in mpengine.dll due to a type confusion error. An unauthenticated, remote attacker can...

KLA11012 Remote code execution vulnerability in the Microsoft Malware Protection Engine

An improper way of scanning files was found in the Microsoft Malware Protection. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed file. Technical details To exploit this vulnerability, a malformed fi...