Microsoft Security Advisory 2491888
Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of Privilege
Published: February 23, 2011 | Updated: March 08, 2011
Microsoft is releasing this security advisory to help ensure customers are aware that an update to the Microsoft Malware Protection Engine also addresses a security vulnerability reported to Microsoft. The update addresses a privately reported vulnerability that could allow elevation of privilege if the Microsoft Malware Protection Engine scans a system after an attacker with valid logon credentials has created a specially crafted registry key. An attacker who successfully exploited the vulnerability could gain the same user rights as the LocalSystem account. The vulnerability could not be exploited by anonymous users.
Since the Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products, the update to the Microsoft Malware Protection Engine is installed along with the updated malware definitions for the affected products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.
Typically, no action is required of enterprise administrators or end users to install this update, because the built-in mechanism for the automatic detection and deployment of this update will apply the update within the next 48 hours. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.
For more information about this issue, see the following references:
|Last version of the Microsoft Malware Protection Engine affected by this vulnerability||Version 1.1.6502.0*|
|First version of the Microsoft Malware Protection Engine with this vulnerability addressed||Version 1.1.6603.0**|
*This version is the last version of the Microsoft Malware Protection Engine that is affected by the vulnerability.
**If your version of the Microsoft Malware Protection Engine is equal to or greater than this version, then you are not affected by this vulnerability and do not need to take any further action. For more information on how to verify the engine version number that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.
Affected Software and Severity Ratings
The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.
The Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products. Depending upon which affected Microsoft anti-malware product is installed, this update may have different severity ratings. The following severity ratings assume the potential maximum impact of the vulnerability.
|Anti-malware Software||Microsoft Malware Protection Engine Vulnerability - CVE-2011-0037|
|Windows Live OneCare||Important
Elevation of Privilege
|Microsoft Security Essentials||Important
Elevation of Privilege
|Microsoft Windows Defender||Important
Elevation of Privilege
|Microsoft Forefront Client Security||Important
Elevation of Privilege
|Microsoft Forefront Endpoint Protection 2010||Important
Elevation of Privilege
|Microsoft Malicious Software Removal Tool||Important
Elevation of Privilege
Applies only to February 2011 or earlier versions of the Microsoft Malicious Software Removal Tool.
|Microsoft Antigen for Exchange|
|Microsoft Antigen for SMTP Gateway|
|Forefront Security for Exchange Server|
|Forefront Protection 2010 for Exchange Server|
|Forefront Threat Management Gateway 2010|
|Microsoft Forefront Security for SharePoint|
|Forefront Security for Office Communications Server|
|Microsoft Standalone System Sweeper (part of Microsoft Diagnostics and Recovery Toolset)|
The following table provides an exploitability assessment of the vulnerability addressed in this advisory.
How do I use this table?
Use this table to learn about the likelihood of functioning exploit code being released within 30 days of this advisory release. You should review the assessment below, in accordance with your specific configuration, in order to prioritize your deployment. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.
|Vulnerability Title||CVE ID||Exploitability Index Assessment||Key Notes|
|Microsoft Malware Protection Engine Vulnerability||CVE-2011-0037||1 - Consistent exploit code likely||This is an elevation of privilege vulnerability|
Frequently Asked Questions (FAQ) About this Advisory
Why was this advisory revised on March 8, 2011?
When this advisory was first released, an updated version of the Malicious Software Removal Tool (MSRT) was not available. Microsoft released an updated version of the MSRT on Tuesday, March 8, 2011 that addresses the vulnerability. Versions of the MSRT released on or after that date are not affected by the vulnerability described in this security advisory.
Why was no update for the Malicious Software Removal Tool (MSRT) available when this Security Advisory was first released?
The vulnerability could only be exploited through February 2011 or earlier versions of the MSRT when the MSRT was initially offered and downloaded using Automatic Updates. Microsoft released an updated version to address the issue in the Malicious Software Removal Tool on Tuesday, March 8, 2011. Versions of the MSRT released on or after that date are not vulnerable to the issue described in this security advisory. MSRT runs only once when downloaded using Automatic Updates. An attacker could not exploit this vulnerability by running a vulnerable version of the MSRT manually.
Is Microsoft releasing a Security Bulletin to address this vulnerability?
No. Microsoft is releasing this informational security advisory to help ensure customers are aware that this Microsoft Malware Protection Engine update also addresses a security vulnerability reported to Microsoft.
Typically, no action is required of enterprise administrators or end users to install this update.
Why is typically no action required to install this update?
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, anti-malware software must be kept up to date with these updates in a timely manner.
For enterprise deployments as well as end users, the default configuration in Microsoft anti-malware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.
Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.
How often are the Microsoft Malware Protection Engine and malware definitions updated?
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.
Depending on which Microsoft anti-malware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.
How can I install the update?
Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.
For more information on installing the latest definitions, visit the Microsoft Malware Protection Center, or refer to your product documentation.
For end users, no further action is required because this security update will be downloaded and installed automatically through automatic updating or through their anti-malware software. For information on how to configure anti-malware software, refer to your product documentation.
For end users who want to install this update manually, refer to the following table.
Note Updates available through Microsoft Update will be listed as Important. Look for the appropriate update for your software with a name similar to the example listed in parenthesis () in the table below.
|Software||Update Mechanism||Other methods of updating|
|Microsoft Security Essentials||Microsoft Update||How to manually download the latest definition updates for Microsoft Security Essentials|
|Microsoft Windows Defender||Windows Update||Install the latest Windows Defender definition updates|
|Microsoft Forefront Client Security||Microsoft Update||Install the latest Microsoft Forefront Security definition updates|
|Microsoft Forefront Endpoint Protection 2010||Microsoft Update
(Example: "Definition Update for Microsoft Forefront Endpoint Protection 2010")
|Install the latest Microsoft Forefront Security definition updates|
|Microsoft Malicious Software Removal Tool||Windows Update||Malicious Software Removal Tool|
Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of this issue. The following mitigating factors may be helpful in your situation:
- An attacker must have valid logon credentials to exploit this vulnerability. The vulnerability could not be exploited by anonymous users.
- An attacker could have used the February 2011 or earlier versions of the Malicious Software Removal Tool (MSRT) to exploit this vulnerability, only if that version of the MSRT had not already run on the system. When this advisory was first released, for the majority of end users, the February 2011 version of the MSRT would already have been downloaded and run automatically through automatic updating. Microsoft released an updated version to address the issue in the Malicious Software Removal Tool on Tuesday, March 8, 2011. Versions of the MSRT released on or after that date are not vulnerable to the issue described in this security advisory.
There is typically no action required for enterprise administrators or end users to install this update. Microsoft recommends that customers keep malware definitions up to date at all times. Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft anti-malware products.
Administrators of enterprise anti-malware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.
For end-users, the affected software provide built-in mechanisms for the automatic detection and deployment of this update. For these customers the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. End users that do not wish to wait can manually update their anti-malware software.
For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to Microsoft Knowledge Base Article 2510781, or refer to the section, Frequently Asked Questions (FAQ) About this Advisory.
Microsoft thanks the following for working with us to help protect customers:
- Cesar Cerrudo of Argeniss for reporting the Microsoft Malware Protection Engine Vulnerability (CVE-2011-0037)
Microsoft Active Protections Program (MAPP)
To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections Web sites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.
- You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.
- Customers in the United States and Canada can receive technical support from Security Support. For more information about available support options, see Microsoft Help and Support.
- International customers can receive support from their local Microsoft subsidiaries. For more information about how to contact Microsoft for international support issues, visit International Support.
- Microsoft TechNet Security provides additional information about security in Microsoft products.
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
- V1.0 (February 23, 2011): Advisory published.
- V1.1 (March 8, 2011): Revised advisory FAQ to announce updated version of the MSRT and added Forefront Security for Exchange Server to the list of non-affected software.
Built at 2014-04-18T13:49:36Z-07:00