CVE-2017-8540 in microsoft malware protection engine
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
Affected software: microsoft malware protection engine, microsoft endpoint protection, microsoft exchange server, microsoft forefront endpoint protection, microsoft forefront security, microsoft intune endpoint protection, microsoft security essentials, microsoft system center endpoint protection, microsoft windows defender
Scores
- CVSS: 7.8 (high)
- EPSS: 71.87% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-03
- Published: 2017-05-26
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update the Microsoft Malware Protection Engine (CVE-2017-8540)
Patch or upgrade. Updates the Microsoft Malware Protection Engine used by Defender, Forefront, System Center Endpoint Protection, Security Essentials and Exchange anti-malware to a version released after the June 2017 fix, removing the memory corruption that a crafted file triggers when it is scanned.
Applies to: Malware Protection Engine up to the last affected version in Microsoft's advisory (May 2017 engines): Windows Defender (Windows 7 SP1 to 10 1703, Server 2008-2016), Forefront, SCEP, Security Essentials, Intune Endpoint Protection, Exchange 2013/2016.
- On each Windows host, open PowerShell as administrator and run: Get-MpComputerStatus | Select AMEngineVersion, AMProductVersion, AntivirusSignatureLastUpdated to read the current engine version.
- Compare the engine version with the fixed version listed in the Microsoft advisory for CVE-2017-8540 (Security Update Guide); any engine released after June 2017 contains the fix, and current engines report 1.1.2xxxx.
- If the engine is outdated, run: Update-MpSignature (or 'C:\Program Files\Windows Defender\MpCmdRun.exe' -SignatureUpdate) to pull the latest engine and definitions; for Forefront / SCEP, trigger a definition update from the client or the Configuration Manager console.
- Check that automatic engine and definition updates are not blocked: WSUS/Configuration Manager must approve the 'Definition Updates' classification, or the host must reach Microsoft Update.
- On Exchange Server 2013 and 2016, run Get-MalwareFilteringServer and check that engine updates are enabled; force an update with the Update-MalwareFilteringServer.ps1 script in the Exchange Scripts folder.
- Run Get-MpComputerStatus again and confirm AMEngineVersion now equals or exceeds the fixed version from the advisory.
- For hosts that cannot be updated, isolate them from untrusted file sources (mail, downloads, removable media) until they are updated.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.