CVE-2017-11937
published 2017-12-07CVE-2017-11937: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold…
PriorityP350high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
28.33%
98.1th percentile
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | malware_protection_engine | <= 1.1.14306.0 | — |
| microsoft_corporation | microsoft_malware_protection_engine | — | — |
| msrc | microsoft_exchange_server_2013 | — | — |
| msrc | microsoft_exchange_server_2016 | — | — |
| msrc | microsoft_forefront_endpoint_protection_2010 | — | — |
| msrc | microsoft_security_essentials | — | — |
| msrc | microsoft_system_center_endpoint_protection | — | — |
| msrc | windows_defender | — | — |
| msrc | windows_intune_endpoint_protection | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc7.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pp2v-f23g-qjhq: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8
ghsa_unreviewed·2022-05-14
CVE-2017-11937 [HIGH] CWE-119 GHSA-pp2v-f23g-qjhq: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
GHSA
GHSA-cv79-m93x-rwg8: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2017-11940 [HIGH] CWE-119 GHSA-cv79-m93x-rwg8: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". This is different than CVE-2017-11937.
Microsoft
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
vendor_msrc·2017-12-12·CVSS 7.8
CVE-2017-11937 [HIGH] Microsoft Malware Protection Engine Remote Code Execution Vulnerability
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsof
No detection rules found.
No public exploits indexed.
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Ausnutzung von Schwachstellen
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft M
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits & Vulnerabilities
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro 2017/12/13 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Malwar
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits & Vulnerabilities
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Malw
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits & Vulnerabilities
# December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro
2017/12/13
Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940, two remote code execution vulnerabilities concerning the Microsoft Malware
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Sfruttamento vulnerabilità
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Malw
Trendmicro
December Patch Tuesday: MMPE Vulnerability Updates
blogs_trendmicro·2017-12-13·CVSS 9.8
[CRITICAL] December Patch Tuesday: MMPE Vulnerability Updates
Exploits y vulnerabilidades
## December Patch Tuesday: MMPE Vulnerability Updates
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. There were only a few notable vulnerabilities that were addressed.
By: Trend Micro Dec 13, 2017 Read time: ( words)
Save to Folio
It was a relatively low-key year-ender for Microsoft’s Patch Tuesday, as the company’s monthly release of updates was relatively light in terms of noteworthy vulnerabilities. With that said, there were still a few notable vulnerabilities that were addressed. Perhaps the most significant of these were CVE-2017-11937 and CVE-2017-11940 , two remote code execution vulnerabilities concerning the Microsoft Mal
Qualys
December 2017 Patch Tuesday: Quiet End to the Year
blogs_qualys·2017-12-12·CVSS 6.6
[MEDIUM] December 2017 Patch Tuesday: Quiet End to the Year
This December Patch Tuesday is considerably lighter than last month’s patch releases. While only three of the fixes were for Windows operating systems, the majority of the vulnerabilities to pay attention to are Browser/Scripting Engine-based.
Overall, this month’s updates address are fixes for 32 unique CVEs, 19 of which are critical, and 24 of which address remote code execution at varying severity levels. No active exploits are listed by Microsoft again this month.
From a prioritization standpoint, again we turn our focus to the browsers and the Scripting Engine Memory Corruption Vulnerabilities. We recommend prioritizing patching user-facing workstations to address the 19 critical Internet Explorer and Edge updates released today by Microsoft, as they are listed as “Exploitation More
Talos
Microsoft Patch Tuesday - December 2017
blogs_talos·2017-12-12·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - December 2017
## Microsoft Patch Tuesday - December 2017
Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 34 new vulnerabilities with 21 of them rated critical and 13 of them rated important. These vulnerabilities impact Edge, Exchange, Internet Explorer, Office, Scripting Engine, Windows, and more.
In addition to the 33 vulnerabilities addressed, Microsoft has also released an update for Microsoft Office which improves security by disabling the Dynamic Data Exchange (DDE) protocol. This update is detailed in ADV170021 and impacts all supported versions of Office. Organizations who are unable to install this update should consult the advisory for workaround that
Talos
Microsoft Patch Tuesday - December 2017
blogs_talos·2017-12-12·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - December 2017
Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 34 new vulnerabilities with 21 of them rated critical and 13 of them rated important. These vulnerabilities impact Edge, Exchange, Internet Explorer, Office, Scripting Engine, Windows, and more.
In addition to the 33 vulnerabilities addressed, Microsoft has also released an update for Microsoft Office which improves security by disabling the Dynamic Data Exchange (DDE) protocol. This update is detailed in ADV170021 and impacts all supported versions of Office. Organizations who are unable to install this update should consult the advisory for workaround that help mitigate DDE exploitation attempts.
##
Qualys
December 2017 Patch Tuesday: Quiet End to the Year | Qualys
blogs_qualys·2017-12-12·CVSS 6.6
[MEDIUM] December 2017 Patch Tuesday: Quiet End to the Year | Qualys
This December Patch Tuesday is considerably lighter than last month’s patch releases. While only three of the fixes were for Windows operating systems, the majority of the vulnerabilities to pay attention to are Browser/Scripting Engine-based.
Overall, this month’s updates address are fixes for 32 unique CVEs, 19 of which are critical, and 24 of which address remote code execution at varying severity levels. No active exploits are listed by Microsoft again this month.
From a prioritization standpoint, again we turn our focus to the browsers and the Scripting Engine Memory Corruption Vulnerabilities. We recommend prioritizing patching user-facing workstations to address the 19 critical Internet Explorer and Edge updates released today by Microsoft, as they are listed as “Exploitation More
http://www.securityfocus.com/bid/102070http://www.securitytracker.com/id/1039972https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937http://www.securityfocus.com/bid/102070http://www.securitytracker.com/id/1039972https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937
2017-12-07
Published