CVE-2017-0290

Google Project Zero researcher Tavis Ormandy has unearthed yet another critical remote code execution vulnerability affecting the Microsoft Malware Protection Engine, which powers a number of the company’s antivirus and antispyware software. Discovered earlier this month with the help of a fuzzer for the Windows Defender component created by Ormandy himself, the vulnerability affects the x86 emulator in Windows Defender, which “runs as SYSTEM, is unsandboxed, is enabled by default and remotely accessible to attackers.” … More →

Microsoft silently patched a second critical vulnerability in its Malware Protection Engine that was discovered on May 12. Microsoft has patched the critical vulnerability in its Malware Protection Engine that was discovered on May 12 by the researchers at the Google’s Project Zero team. The vulnerability could be exploited by an attacker that has crafted an executable that […]

A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. First of all, let me inform you that at the #infosec16 SecurityAffairs was awarded as The Best European Personal Security Blog http://securityaffairs.co/wordpress/48202/breaking-news/securityaffairs-best-european-personal-security-blog.html · Business email compromise (BEC), the 5 billion dollar scam · European law enforcement takes down Darknet […]

On Monday night, Microsoft released a critical out-of-band security update for the Microsoft Malware Protection Engine, to plug an easily exploitable bug that could allow remote attackers to compromise target Windows machines. The vulnerability (CVE-2017-0290) The vulnerability can be exploited to execute arbitrary code in the security context of the LocalSystem account. This would allow attackers to take control of the target system, install programs, view, change, or delete data, create new accounts with full … More →

Microsoft fixes the vulnerability in the Microsoft Malware Protection Engine (CVE-2017-0290) discovered just three days by Google experts. Last week the researchers at the Google Project Zero team have discovered a new critical Windows RCE vulnerability, tracked as CVE-2017-0290, they defined the bug as the worst Windows RCE in recent memory. I think @natashenka and […]

It took Microsoft less than three days to patch a critical remote code execution vulnerability found by Google Project Zero researchers in the company’s Malware Protection Engine. Most users don’t need to take any action as the affected products should be updated automatically.