Major Security Flaw Discovered in the Microsoft Malware Protection Engine
- by Bill Lindner on 20070215 @ 10:39PM EST | google it | send to friends
- Filed under Security | (related terms: windows defender, security, malware protection engine, forefront security, vulnerability)
Oops!
It looks like Microsoft has once again scrambled to update a recently discovered vulnerability in their Malware Protection Engine, used by the Windows Defender security programs.
A security bulletin (MS07-010) has been issued by Microsoft (MS) for users of it's highly touted Windows Defender security program that affects 8 MS products.
The security bulletin, rated "critical" details how a remote code execution vulnerability in the Microsoft Malware Protection Engine because of the way it parses Portable Document Format (PDF) files.
Product and version numbers affected:
- Windows Live OneCare -- 1.1.2101.0
- Microsoft Antigen for Exchange 9.x -- 0.1.8.53
- Microsoft Antigen for SMTP Gateway 9.x -- 0.1.8.53
- Microsoft Windows Defender -- 1.1.2101.0
- Microsoft Windows Defender in Windows Vista -- 1.1.2101.0
- Microsoft Windows Defender x64 Edition -- 1.1.2101.0
- Microsoft Forefront Security for Exchange Server -- 0.1.8.53
- Microsoft Forefront Security for SharePoint -- 0.1.8.53
In a nutshell: an attacker could exploit the vulnerability by constructing a specially crafted PDF file that may allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file.
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection and cleaning capabilities for the following antivirus and antispyware clients: Windows Live OneCare, Microsoft Forefront Security, Microsoft Antigen, and Windows Defender.
Users of the affected software are encouraged to update their products immediately.
You do have to wonder though, how this type of flaw can happen when Microsoft keeps hyping up all the "security" of their new operating system.
Visit Bill's Links and More for more great tips, just like this one!
Related articles:
- 2007/10/15 Parts of Vista Incorporated Into Windows XP SP3
- 2007/12/18 Zero Day Flaw Affects 82 HP Laptop Models
- 2008/04/16 Murdoch Adds To Yahoo Ballyhoo
- 2008/03/21 MSNBC Sports Hacked
- 2008/01/30 Ready or Not, Here Comes Internet Explorer 7
- 2007/12/19 Microsoft Updates Hinder More than Help
- 2007/10/11 Microsoft Patches Itself Up
- 2008/04/21 Is 'Racial Profiling' the Way to Compete with Google?
- 2008/01/03 Google Merger to Usurp Control of Internet Ad Market ...
- 2008/03/11 Free Google App Attacks Sharepoint
Stay Informed: Subscribe Free to Infopackets, Today! Get your daily fix of Microsoft Windows news, reviews, tech tips, plus free software (freeware) goodies daily -- all absolutely free -- delivered straight to your email inbox! Bonus: join our website today and you'll also receive our highly coveted Top 10 Tech Reports, including: Top 10 PC Security Essentials, Windows Optimization Secrets, Top Freeware Antivirus, MS Office alternatives and more. Don't delay: subscribe today! Click here for more info.
Infopackets Game of the Week
Secrets of the Dark: Eclipse Mountain Collector's Edition
