Vulnerability-Lookup

CNVD-2017-06157

Vulnerability from cnvd - Published: 2017-05-09

Title

Microsoft Malware Protection Engine远程代码执行漏洞

Description

Microsoft恶意软件保护引擎（mpengine.dll）可为防病毒和反间谍软件客户端提供扫描、监测和清除功能。 Microsoft Malware Protection Engine存在远程代码执行漏洞。当Microsoft恶意软件保护引擎未能正确扫描攻击者精心构造的文件导致内存破坏时，可触发远程代码执行漏洞。攻击者可在LocalSystem账户下执行任意代码，并控制系统。攻击者可以安装程序，查看、更改或删除数据，甚至创建具有完整用户权限的新帐户。

Severity

高

Patch Name

Microsoft Malware Protection Engine远程代码执行漏洞的补丁

Patch Description

Formal description

用户可联系供应商获得补丁信息： https://technet.microsoft.com/en-us/library/security/4022344

Reference

https://technet.microsoft.com/en-us/library/security/4022344 https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5

Impacted products

Name
Microsoft Malware Protection Engine 1.1.13701.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-0290"
    }
  },
  "description": "Microsoft\u6076\u610f\u8f6f\u4ef6\u4fdd\u62a4\u5f15\u64ce\uff08mpengine.dll\uff09\u53ef\u4e3a\u9632\u75c5\u6bd2\u548c\u53cd\u95f4\u8c0d\u8f6f\u4ef6\u5ba2\u6237\u7aef\u63d0\u4f9b\u626b\u63cf\u3001\u76d1\u6d4b\u548c\u6e05\u9664\u529f\u80fd\u3002\r\n\r\nMicrosoft Malware Protection Engine\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u5f53Microsoft\u6076\u610f\u8f6f\u4ef6\u4fdd\u62a4\u5f15\u64ce\u672a\u80fd\u6b63\u786e\u626b\u63cf\u653b\u51fb\u8005\u7cbe\u5fc3\u6784\u9020\u7684\u6587\u4ef6\u5bfc\u81f4\u5185\u5b58\u7834\u574f\u65f6\uff0c\u53ef\u89e6\u53d1\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5728LocalSystem\u8d26\u6237\u4e0b\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5e76\u63a7\u5236\u7cfb\u7edf\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5b89\u88c5\u7a0b\u5e8f\uff0c\u67e5\u770b\u3001\u66f4\u6539\u6216\u5220\u9664\u6570\u636e\uff0c\u751a\u81f3\u521b\u5efa\u5177\u6709\u5b8c\u6574\u7528\u6237\u6743\u9650\u7684\u65b0\u5e10\u6237\u3002",
  "discovererName": "Natalie Silvanovich \u548cTavisOrmandy",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://technet.microsoft.com/en-us/library/security/4022344",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-06157",
  "openTime": "2017-05-09",
  "patchDescription": "Microsoft\u6076\u610f\u8f6f\u4ef6\u4fdd\u62a4\u5f15\u64ce\uff08mpengine.dll\uff09\u53ef\u4e3a\u9632\u75c5\u6bd2\u548c\u53cd\u95f4\u8c0d\u8f6f\u4ef6\u5ba2\u6237\u7aef\u63d0\u4f9b\u626b\u63cf\u3001\u76d1\u6d4b\u548c\u6e05\u9664\u529f\u80fd\u3002\r\n\r\nMicrosoft Malware Protection Engine\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u5f53Microsoft\u6076\u610f\u8f6f\u4ef6\u4fdd\u62a4\u5f15\u64ce\u672a\u80fd\u6b63\u786e\u626b\u63cf\u653b\u51fb\u8005\u7cbe\u5fc3\u6784\u9020\u7684\u6587\u4ef6\u5bfc\u81f4\u5185\u5b58\u7834\u574f\u65f6\uff0c\u53ef\u89e6\u53d1\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5728LocalSystem\u8d26\u6237\u4e0b\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5e76\u63a7\u5236\u7cfb\u7edf\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5b89\u88c5\u7a0b\u5e8f\uff0c\u67e5\u770b\u3001\u66f4\u6539\u6216\u5220\u9664\u6570\u636e\uff0c\u751a\u81f3\u521b\u5efa\u5177\u6709\u5b8c\u6574\u7528\u6237\u6743\u9650\u7684\u65b0\u5e10\u6237\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Malware Protection Engine\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Microsoft Malware Protection Engine 1.1.13701.0"
  },
  "referenceLink": "https://technet.microsoft.com/en-us/library/security/4022344\r\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1252\u0026desc=5",
  "serverity": "\u9ad8",
  "submitTime": "2017-05-09",
  "title": "Microsoft Malware Protection Engine\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2017-0290 (GCVE-0-2017-0290)

Vulnerability from cvelistv5 – Published: 2017-05-09 06:03 – Updated: 2024-08-05 13:03

Summary

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability."

Severity

No CVSS data available.

CWE

Remote Code Execution

Assigner

microsoft mitre root

References

10 references

URL	Tags
https://arstechnica.com/information-technology/20…	x_refsource_MISC
https://bugs.chromium.org/p/project-zero/issues/d…	x_refsource_MISC
https://portal.msrc.microsoft.com/en-US/security-…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038420	vdb-entryx_refsource_SECTRACK
https://www.exploit-db.com/exploits/41975/	exploitx_refsource_EXPLOIT-DB
http://www.securitytracker.com/id/1038419	vdb-entryx_refsource_SECTRACK
https://0patch.blogspot.si/2017/05/0patching-wors…	x_refsource_MISC
https://twitter.com/natashenka/status/86174839740…	x_refsource_MISC
https://technet.microsoft.com/library/security/4022344	x_refsource_CONFIRM
http://www.securityfocus.com/bid/98330	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
Microsoft Corporation	Microsoft Malware Protection Engine	Affected: Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016

Date Public

2017-05-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:03:55.875Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1252"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290"
          },
          {
            "name": "1038420",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038420"
          },
          {
            "name": "41975",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/41975/"
          },
          {
            "name": "1038419",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038419"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/natashenka/status/861748397409058816"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://technet.microsoft.com/library/security/4022344"
          },
          {
            "name": "98330",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98330"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Malware Protection Engine",
          "vendor": "Microsoft Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016"
            }
          ]
        }
      ],
      "datePublic": "2017-05-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-15T09:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1252"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290"
        },
        {
          "name": "1038420",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038420"
        },
        {
          "name": "41975",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/41975/"
        },
        {
          "name": "1038419",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038419"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/natashenka/status/861748397409058816"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://technet.microsoft.com/library/security/4022344"
        },
        {
          "name": "98330",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98330"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2017-0290",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Microsoft Malware Protection Engine",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/",
              "refsource": "MISC",
              "url": "https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/"
            },
            {
              "name": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1252",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1252"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290"
            },
            {
              "name": "1038420",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038420"
            },
            {
              "name": "41975",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/41975/"
            },
            {
              "name": "1038419",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038419"
            },
            {
              "name": "https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html",
              "refsource": "MISC",
              "url": "https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html"
            },
            {
              "name": "https://twitter.com/natashenka/status/861748397409058816",
              "refsource": "MISC",
              "url": "https://twitter.com/natashenka/status/861748397409058816"
            },
            {
              "name": "https://technet.microsoft.com/library/security/4022344",
              "refsource": "CONFIRM",
              "url": "https://technet.microsoft.com/library/security/4022344"
            },
            {
              "name": "98330",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98330"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2017-0290",
    "datePublished": "2017-05-09T06:03:00.000Z",
    "dateReserved": "2016-09-09T00:00:00.000Z",
    "dateUpdated": "2024-08-05T13:03:55.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-06157

CVE-2017-0290 (GCVE-0-2017-0290)

Tags

Sightings

Nomenclature

Related by attack behaviour