[Full-disclosure] Microsoft Malware Protection Engine TWO DoS Vulnerabilities
- From: Sowhat <smaillist@xxxxxxxxx>
- Date: Wed, 14 May 2008 11:21:12 +0800
Microsoft Malware Protection Engine TWO DoS Vulnerabilities
By Sowhat of Nevis Labs
Windows Live OneCare
Microsoft Antigen for Exchange
Microsoft Antigen for SMTP Gateway
Microsoft Windows Defender
Microsoft Forefront Client Security
Microsoft Forefront Security for Exchange Server
Microsoft Forefront Security for SharePoint
Standalone System Sweeper located in Diagnostics and Recovery Toolset 6.0
There are two vulnerabilities idenitified in Microsoft Antivirus product.
These vulnerabilities can be exploited to cause Denial of service.
1. CVE-2008-1437 PE Parsing Memory Corruption
While scanning a specially crafted PE file, Malware orotection engine
(MsMpEng.exe/mpengine.dll for Windows Live OneCare) will crash.
Currently, There's no evidence of code execution found.
Please note that this vulnerability can be triggered in various ways:
a. by sending emails to target mail server which is protected by MS
b. by sending emails to victim who is using Windows Onecare or Windows
c. by convining the victim to visit some websites.
d. by sending files (can be any extension) to victims through P2P/IM.
Real Time protection is enabled by default, so in the case b&c, the
can be exploited without any further user interaction after the victim
the email or opened the website.
2. CVE-2008-1438 PE Parsing Disk Space D.o.S
While parsing a specially crafted file with a malformed "size of header"
is scanned by Microsoft Windows OneCare, there will be Disk Space DOS
Microsoft Malware protection engine will allocate disk space as much as the
"claimed", It can "eat" several Gb disk space of Windows installation
Proof of Concept:
No POC will be released.
Microsoft has released an update address this issue.
2008.04.18 Vendor notified via email
2008.04.18 Vendor response, developing for patch
2008.05.14 Patch Release
2008.05.14 Advisory released
"Life is like a bug, Do you know how to exploit it ?"
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: Re: [Full-disclosure] Geeks
- Next by Date: [Full-disclosure] SECNAP IS CRAP
- Previous by thread: [Full-disclosure] Geeks
- Next by thread: [Full-disclosure] SECNAP IS CRAP