Monday, 19 February 2007

Vulnerability in Microsoft Malware Protection Engine

Symantec Security Response rates the Microsoft Malware Engine vulnerability to be the most critical of the security bulletins. This remote code execution vulnerability has affected various Microsoft products that include the Malware Protection Engine, including Windows Live OneCare, Microsoft Antigen 9.x, Microsoft Windows Defender, Microsoft ForeFront Security for Microsoft Exchange Server 1.x, and Microsoft ForeFront Security for SharePoint Server 1.x.

This vulnerability occurs when Microsoft’s AntiVirus client that uses the Microsoft Malware Protection Engine is configured to allow PDF file processing. This vulnerability is critical since the malicious PDF could be hosted on a Web site or distributed via e-mail where it could be scanned by the infected AV engine at the gateway or when it arrives at the desktop. A successful exploit will completely compromise the affected computer, the security firm said.

Microsoft also issued patches for multiple vulnerabilities in Microsoft Word, which corrects the zero-day Word vulnerabilities associated with Trojan.Mdropper.T/W/X, which are Trojan horses that attempt to drop additional threats on the compromised computer. This bulletin also includes a patch for client-side code execution vulnerability in Microsoft Word that can be triggered by a malformed object embedded within a document. A successful exploit could let a remote attacker execute arbitrary code in the context of the currently logged in user, the company explained.