CVE-2017-11937 : The Microsoft Malware Protection Engine running on Microsoft Forefront and Micro

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".

Published 2017-12-07 17:29:00

Updated 2018-10-30 16:27:59

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2017-11937

Microsoft » Malware Protection Engine
Versions up to, including, (<=) 1.1.14306.0
cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Exchange Server » Version: 2013
When used together with: Microsoft » Exchange Server » Version: 2016
When used together with: Microsoft » Forefront Endpoint Protection 2010 » Version: N/A
When used together with: Microsoft » Windows Defender » Version: N/A
When used together with: Microsoft » Windows 10 » Version: N/A
When used together with: Microsoft » Windows 10 » Version: 1511
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows 10 » Version: 1703
When used together with: Microsoft » Windows 10 » Version: 1709
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Rt 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2016 » Version: N/A
When used together with: Microsoft » Windows Server 2016 » Version: 1709

Exploit prediction scoring system (EPSS) score for CVE-2017-11937

EPSS FAQ

32.59%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-11937

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-11937

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-11937

http://www.securitytracker.com/id/1039972

Microsoft Malware Protection Engine File Processing Memory Corruption Flaws Let Remote Users Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/102070

Microsoft Malware Protection Engine CVE-2017-11937 Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11937

CVE-2017-11937 | Microsoft Malware Protection Engine Remote Code Execution Vulnerability
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2017-11937

Products affected by CVE-2017-11937

Exploit prediction scoring system (EPSS) score for CVE-2017-11937

CVSS scores for CVE-2017-11937

CWE ids for CVE-2017-11937

References for CVE-2017-11937