Remote code execution

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not...

KLA11029 Multiple vulnerabilities in the Microsoft Malware Protection Engine

Multiple serious vulnerabilities have been found in Microsoft Malware Protection Engine. Malicious users can exploit these vulnerabilities to cause a denial of service and execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities related to an improper...

Microsoft Malware Protection Engine Remote Code Execution Vulnerability

The Microsoft Malware Protection Engine mpengine.dll provides scanning, monitoring and removal capabilities for antivirus and anti-spyware clients. A remote code execution vulnerability exists in Microsoft Malware Protection Engine. The remote code execution vulnerability can be triggered when...

MS Security Advisory 4022344: Security Update for Microsoft Malware Protection Engine

The version of Microsoft Malware Protection Engine MMPE installed on the remote Windows host is prior to 1.1.13704.0. It is, therefore, affected by a remote code execution vulnerability in the NScript component in mpengine.dll due to a type confusion error. An unauthenticated, remote attacker can...

KLA11012 Remote code execution vulnerability in the Microsoft Malware Protection Engine

An improper way of scanning files was found in the Microsoft Malware Protection. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed file. Technical details To exploit this vulnerability, a malformed fi...

Microsoft Issues Emergency Patch For Critical RCE in Windows Malware Scanner

Microsoft's own antivirus software made Windows 7, 8.1, RT and 10 computers, as well as Windows Server 2016 more vulnerable. Microsoft has just released an out-of-band security update to patch the crazy bad bug discovered by a pair of Google Project Zero researchers over the weekend. Security...

Microsoft Malware Protection Engine Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSyste...

Aviation-Related Phishing Campaigns Seeking Credentials

A wave of email-based phishing campaigns is targeting airline consumers with messages that contain malware that infects systems or links to spoofed airline websites that are personalized to trick victims into handing over personal or business credentials. “Over the past several weeks, we have see...

No payment necessary: Fighting back against ransomware

Note: Read our latest comprehensive report on ransomware: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene. Any IT professional who’s ever had an experience with malware knows how fast an intrusive attack can happen, and how difficult it can be to educate...

CVE-2014-2779

mpengine.dll in Microsoft Malware Protection Engine before 1.1.10701.0 allows remote attackers to cause a denial of service system hang via a crafted file...

Design/Logic Flaw

mpengine.dll in Microsoft Malware Protection Engine before 1.1.10701.0 allows remote attackers to cause a denial of service system hang via a crafted file...

CVE-2014-2779

CVE-2014-2779 affects the Microsoft Malware Protection Engine (MMPE) prior to version 1.1.10701.0. A crafted file can cause the MMPE to stop monitoring, leading to a denial of service (system hang). The vulnerability is exploitable remotely over the network. Mitigation is to update MMPE to versio...

MS Security Advisory 2974294: Vulnerability in Microsoft Malware Protection Engine Could Allow Denial of Service

A vulnerable version of Microsoft Malware Protection Engine MMPE is installed on the remote host. Scanning a maliciously crafted file could prevent the Malware Protection Engine from monitoring affected systems until the file is manually removed and the service is restarted. This plugin checks if...

CVE-2013-1346

mpengine.dll in Microsoft Malware Protection Engine before 1.1.9506.0 on x64 platforms allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted file...

MS Security Advisory 2846338: Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution

A vulnerable version of Microsoft Malware Protection Engine MMPE is installed on the remote host. Scanning a maliciously crafted file can result in arbitrary code execution. This plugin checks if a vulnerable version of MMPE is being used by any of the following applications : - Microsoft Forefro...

The Curious Case of Carl A. …Someone

On the list of things made obsolete by the Internet, signatures are right up there with paperback books and the postal service, but the Microsoft Malware Protection Center decided to dig deeper into the signature of Carl A. unreadable last name anyway and see why it keeps turning up in malware...

MS KB2491888: Microsoft Malware Protection Engine (MMPE) Privilege Escalation

A vulnerable version of Microsoft Malware Protection Engine MMPE is installed on the remote system. MMPE is typically included with Microsoft anti-malware products such as Windows Live OneCare, Microsoft Security Essentials, Microsoft Forefront Client Security, Microsoft Forefront Client Security...

China Hardest Hit by Latest IE Malware Attacks

Computer users in China and Korea were the hardest hit by the latest wave of zero-day malware attacks targeting a flaw in the Internet Explorer browser, according to data released by the Microsoft Malware Protection Center MMPC. The attacks, first spotted on March 9, included Trojan downloaders a...

The reality of System Management Mode attacks

Another day arrives and, with it, another way to run code. This time, it’s executing arbitrary code in System Management Mode SMM memory. That sounds kind of exciting, right? A SMM rootkit? Does that mean that we need an anti-malware scanner for SMM memory now? Or will it just fade away? All this...

Microsoft Malware Protection Engine TWO DoS Vulnerabilities

CVE-2008-1437 CVE-2008-1438 There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service. 1. CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine...