CVE-2017-11940 : The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". This is different than CVE-2017-11937.

Published 2017-12-08 14:29:00

Updated 2018-10-30 16:27:59

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Exploit prediction scoring system (EPSS) score for CVE-2017-11940

Probability of exploitation activity in the next 30 days: 13.11%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 95 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2017-11940

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-11940

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-11940

http://www.securitytracker.com/id/1039972

Microsoft Malware Protection Engine File Processing Memory Corruption Flaws Let Remote Users Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/102104

Microsoft Malware Protection Engine CVE-2017-11940 Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11940

CVE-2017-11940 | Microsoft Malware Protection Engine Remote Code Execution Vulnerability
Patch;Vendor Advisory

Products affected by CVE-2017-11940

Microsoft » Malware Protection Engine
Versions up to, including, (<=) 1.1.14306.0
cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Exchange Server » Version: 2013
When used together with: Microsoft » Exchange Server » Version: 2016
When used together with: Microsoft » Forefront Endpoint Protection 2010 » Version: N/A
When used together with: Microsoft » Windows Defender » Version: N/A
When used together with: Microsoft » Windows 10 » Version: N/A
When used together with: Microsoft » Windows 10 » Version: 1511
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows 10 » Version: 1703
When used together with: Microsoft » Windows 10 » Version: 1709
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Rt 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2016 » Version: N/A
When used together with: Microsoft » Windows Server 2016 » Version: 1709

Vulnerability Details : CVE-2017-11940

Exploit prediction scoring system (EPSS) score for CVE-2017-11940

CVSS scores for CVE-2017-11940

CWE ids for CVE-2017-11940

References for CVE-2017-11940

Products affected by CVE-2017-11940