lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 28 Mar 2020 00:48:54 +0100
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: "Paul Szabo" <paul.szabo@...ney.edu.au>,
	<fulldisclosure@...lists.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: [FD] Defense in depth -- the Microsoft way (part 64): Windows
	Defender loads and exeutes arbitrary DLLs

"Paul Szabo" <paul.szabo@...ney.edu.au> wrote:

> Does this mean that unprivileged users can defeat WindowsDefender,
> even when that is "enforced" by managers? Surely that would be a
> vulnerability! I am not knowledgeable about Windows management,
> but the pages
> https://docs.microsoft.com/en-us/configmgr/protect/deploy-use/endpoint-protection
>
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus
> suggest that enforcement of WindowsDefender is a supported feature.

Yes, partially: this vulnerability allows unprivileged users
a) to bypass "on-demand" scans of files downloaded from the internet
   or other computers (which are initiated by the attachment manager),
b) to load an arbitrary DLL whenever a program calls the attachment
   manager or the IOfficeAntiVirus interface to initiate an "on-demand"
   scan;
"realtime" scans initiated via the file system filter driver of the
anti-malware platform are NOT affected.

regards
Stefan

> On 2020-03-27 15:27, Stefan Kanthak wrote:
>> in September 2017, Microsoft relocated many executable files of Windows
>> Defender from the directory "%ProgramFiles%\Windows Defender\" to
>> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\" ...
>> Of special interest here is the IOfficeAntiVirus implementation ...
>> This interface is called by the attachment manager ...
>> "Thanks" to the environment variable specified in the registered path
>> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\MpOav.dll",
>> an unprivileged user/attacker can provide an arbitrary DLL which is
>> then loaded and executed ...
>> ...
>> Vendor statement:
>> The MSRC assigned case 57439 to the above report, and replied with the
>> following statements:
>> | After investigation, our engineers have determine this this behavior
>> | is by-design and does not constitute as a vulnerability as reported.
>> ...


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists