"Paul Szabo" <paul.sz...@sydney.edu.au> wrote: > Does this mean that unprivileged users can defeat WindowsDefender, > even when that is "enforced" by managers? Surely that would be a > vulnerability! I am not knowledgeable about Windows management, > but the pages > https://docs.microsoft.com/en-us/configmgr/protect/deploy-use/endpoint-protection > https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus > suggest that enforcement of WindowsDefender is a supported feature.
Yes, partially: this vulnerability allows unprivileged users a) to bypass "on-demand" scans of files downloaded from the internet or other computers (which are initiated by the attachment manager), b) to load an arbitrary DLL whenever a program calls the attachment manager or the IOfficeAntiVirus interface to initiate an "on-demand" scan; "realtime" scans initiated via the file system filter driver of the anti-malware platform are NOT affected. regards Stefan > On 2020-03-27 15:27, Stefan Kanthak wrote: >> in September 2017, Microsoft relocated many executable files of Windows >> Defender from the directory "%ProgramFiles%\Windows Defender\" to >> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\" ... >> Of special interest here is the IOfficeAntiVirus implementation ... >> This interface is called by the attachment manager ... >> "Thanks" to the environment variable specified in the registered path >> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\MpOav.dll", >> an unprivileged user/attacker can provide an arbitrary DLL which is >> then loaded and executed ... >> ... >> Vendor statement: >> The MSRC assigned case 57439 to the above report, and replied with the >> following statements: >> | After investigation, our engineers have determine this this behavior >> | is by-design and does not constitute as a vulnerability as reported. >> ... _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/