Microsoft Issues Critical Windows 10 Patch For Windows Defender

With about a week to go before this month's Patch Tuesday rolls into view, Microsoft has issued a batch of security updates to address a critical vulnerability affecting Windows Defender and a spatter of other antimalware services, such as Windows Intune Endpoint Protection. Left unpatched, an attacker could weasel his malicious wares onto a system remotely and even create new accounts with full system permissions.

The vulnerability lies in Microsoft's Malware Protection Engine, or mpengine.dll. This is the main component of Windows Defender in Windows 10, and if left unpatched, affected systems are susceptible to all kinds of potential nastiness.

"An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights," Microsoft says.

The security flaw has to do with not properly scanning a specially crafted file, which leads to memory corruption. Microsoft notes there are many ways an attacker could drop a malicious file file in a location that is scanned by its Malware Protection Engine. One way is to place the file on a website. An attacker could also send it through email or by way of an instant message.

"If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited," Microsoft says.

Either way, all systems running an affected version of antimalware software are primarily at risk. That is where the security updates come into play. Technically it's not an out-of-band patch because Microsoft updates its Windows Defender engine as needed. Still, this is the sort of thing that would be released outside of a normal update schedule, if it weren't part of the Malware Protection Engine.

Top Image Source: Pixabay