"Paul Szabo" <paul.sz...@sydney.edu.au> wrote:

> Does this mean that unprivileged users can defeat WindowsDefender,
> even when that is "enforced" by managers? Surely that would be a
> vulnerability! I am not knowledgeable about Windows management,
> but the pages
> https://docs.microsoft.com/en-us/configmgr/protect/deploy-use/endpoint-protection
> suggest that enforcement of WindowsDefender is a supported feature.

Yes, partially: this vulnerability allows unprivileged users
a) to bypass "on-demand" scans of files downloaded from the internet
   or other computers (which are initiated by the attachment manager),
b) to load an arbitrary DLL whenever a program calls the attachment
   manager or the IOfficeAntiVirus interface to initiate an "on-demand"
"realtime" scans initiated via the file system filter driver of the
anti-malware platform are NOT affected.


> On 2020-03-27 15:27, Stefan Kanthak wrote:
>> in September 2017, Microsoft relocated many executable files of Windows
>> Defender from the directory "%ProgramFiles%\Windows Defender\" to
>> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\" ...
>> Of special interest here is the IOfficeAntiVirus implementation ...
>> This interface is called by the attachment manager ...
>> "Thanks" to the environment variable specified in the registered path
>> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\MpOav.dll",
>> an unprivileged user/attacker can provide an arbitrary DLL which is
>> then loaded and executed ...
>> ...
>> Vendor statement:
>> The MSRC assigned case 57439 to the above report, and replied with the
>> following statements:
>> | After investigation, our engineers have determine this this behavior
>> | is by-design and does not constitute as a vulnerability as reported.
>> ...

Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/

Reply via email to