Microsoft quickly fixes 'crazy bad' Windows bug

Microsoft quickly fixes 'crazy bad' Windows bug

Microsoft quickly fixes 'crazy bad' Windows bug

The flaw is inside Windows Defender. Microsoft has already released a patch for the problem.

Microsoft delivered the patch today, just three days after Google's Project Zero members Natalie Silvanovich and Tavis Ormandy informed Microsoft about a remotely exploitable flaw in the Microsoft Malware Protection Engine.

The latest issue is the most critical to date.

At the time, Ormandy only said the vulnerability was "the worst Windows remote code exec in recent memory" and that the issue was "wormable" and even a default installation could be exploited.

To bring the streamlined performance, simplicity and security of Windows 10 S to university students, Microsoft is expanding the Surface family of devices with Surface Laptop.

The exploit is incredibly easy to trigger: Anything that causes data to be written to a disk starts the Protection Engine's scan and could activate the code.

In trying to remove malware from the machine, Windows Defender could give it a foothold into the system.

Microsoft quickly fixes 'crazy bad' Windows bug

Anyone who uses Windows should update their PC right now.

The Project Zero team says the vulnerability can be leveraged against victims by only sending an email to users - without the need for the message to be opened or any attachments to be downloaded. Microsoft is planning to allow developers to add bots to the company's Bing search results to let you to chat with restaurants and other retailers.

"If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned", Microsoft wrote in its advisory.

And as the MMPE software and associated processes run at the elevated LocalSystem privilege level, a successful attack could lead to full remote system compromise, Microsoft warned.

Microsoft is holding its cards close to its chest, and there could be big surprises we haven't anticipated regarding HoloLens, Windows Mobile, Windows Holographic, Xbox or even Clippy. This was an unusually fast response for the company, which typically releases security updates on the second Tuesday of every month and rarely breaks out of that cycle.

One reason that the bug is so risky is that it is triggered when software such as Windows Defender scans messages, and on many computers these applications are configured to scan messages automatically, without any user interaction. The engine is used by Windows Defender, the malware scanner preinstalled on Windows 7 and later, as well as by other Microsoft consumer and enterprise security products: Microsoft Security Essentials, Microsoft Forefront Endpoint Protection 2010, Microsoft Endpoint Protection, Microsoft Forefront Security for SharePoint Service Pack 3, Microsoft System Center Endpoint Protection and Windows Intune Endpoint Protection.

The vulnerable version of MMPE is 1.1.13701.0, and the first with the fix implemented is 1.1.13704.0.

Recommended News

  • Ousted minister Kapil Mishra files 3 complaints with CBI

    Mishra approached the CBI a day after he was suspended from the AAP after he levelled fresh corruption allegations against Kejriwal.
    Monaco Maintain Top Spot, PSG Put Five Past Bastia

    Monaco Maintain Top Spot, PSG Put Five Past Bastia

    However, the hosts took the throw quickly and Verratti smashed a shot into the net from the edge of the area, catching out Leca. Marseille have ended Nice's hopes of clinching the title, after they ran out 2-1 winners on Sunday evening.

    Israel says Palestinian hunger strike leader ate in secret

    Fares says strike organizer and Palestinian uprising leader Marwan Barghouti remains in solidarity confinement. The hunger strike led by Palestinian freedom fighter Marwan Barghouthi began on April 17.
  • "Edge Of Tomorrow" Sequel Gets Returning Cast Members And Redundant Title

    And again that's why I try to do things like " Invisible " that are just, the revolution's sort of built into the idea. When will Live Die Repeat and Repeat be released? Liman was asked about the state of the sequel for Edge of Tomorrow .
    Oil price under pressure amid over-supply worries

    Oil price under pressure amid over-supply worries

    The cuts in production resulted in a significant rally in oil prices , with Brent trading as high as $56 per barrel in February. Pugh believes Opec and Russian Federation are likely to extend the cuts by at least three months at the meeting.
    Le Pen sees French presidential vote 'surprise'

    Le Pen sees French presidential vote 'surprise'

    Returning to the franc is part of Le Pen's platform, but she has recently softened her tone to attract voters. A Harris survey saw Macron going on to win the run-off against her by 64 percent to 36.
  • Charlton County closes schools as West Mims Fire breaks containment again

    Charlton County closes schools as West Mims Fire breaks containment again

    Six years ago, a wildfire burned more than 300,000 acres of the 407,000-acre refuge, said Mark Davis, a spokesman for the U.S. County Administrator Shawn Boatright couldn't immediately say how many residents might be affected in the latter area.

    Zuccarello leads Rangers to 4-1 win over Senators in Game 3

    Then, at 15:54, Lindberg floated a shot from the left wing that somehow eluded Anderson after a strong forecheck by Glass and J.T. Vesey pulled the Rangers in front 4-3 with his first career playoff goal when he pounced on a rebound of Brady Skjei's shot.
    Theresa May 'taking nothing for granted' despite local elections triumph

    Theresa May 'taking nothing for granted' despite local elections triumph

    The Tories secured more than 550 council seats and seized control of 11 additional councils in this week's contests. In the previous local elections, UKIP saw a surge of voters when it campaigned on a single issue of Brexit.
  • Conrad Hilton arrested for alleged car theft in Los Angeles

    Conrad Hilton arrested for alleged car theft in Los Angeles

    Paris Hilton hinted at becoming engaged to boyfriend Chris Zylka just hours before her little brother went on a crime spree. Hilton , 23, is said to have been caught near his ex-girlfriend's Hollywood Hills home at 4 a.m. on Saturday morning.
    50000 evacuated in German city after 5 WWII bombs uncovered

    50000 evacuated in German city after 5 WWII bombs uncovered

    On 9 October 1943, an especially deadly night, 1,245 people were killed and 250,000 left homeless by 261,000 bombs. The thousands of people being evacuated from the city will have the chance to attend events.
    Israel's Ministerial Committee for Legislation Unanimously Approves Controversial 'Nationality Law'

    Israel's Ministerial Committee for Legislation Unanimously Approves Controversial 'Nationality Law'

    This is a basic law , which has the simple objective of safeguarding Israel's status as the nation state of the Jewish people. Critics, however, said that the bill is discriminatory to Israel's Palestinians and other minority populations.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.