full-disclosure - Re: [FD] Defense in depth -- the Microsoft way (part 64): Windows Defender loads and exeutes arbitrary DLLs

Open Source and information security mailing list archives

Message-ID: <C509631CCA834CD49C8442055FF6762B@H270>
Date: Sat, 28 Mar 2020 00:48:54 +0100
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: "Paul Szabo" <paul.szabo@...ney.edu.au>,
	<fulldisclosure@...lists.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: [FD] Defense in depth -- the Microsoft way (part 64): Windows
	Defender loads and exeutes arbitrary DLLs

"Paul Szabo" <paul.szabo@...ney.edu.au> wrote:

> Does this mean that unprivileged users can defeat WindowsDefender,
> even when that is "enforced" by managers? Surely that would be a
> vulnerability! I am not knowledgeable about Windows management,
> but the pages
> https://docs.microsoft.com/en-us/configmgr/protect/deploy-use/endpoint-protection
>
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus
> suggest that enforcement of WindowsDefender is a supported feature.

Yes, partially: this vulnerability allows unprivileged users
a) to bypass "on-demand" scans of files downloaded from the internet
   or other computers (which are initiated by the attachment manager),
b) to load an arbitrary DLL whenever a program calls the attachment
   manager or the IOfficeAntiVirus interface to initiate an "on-demand"
   scan;
"realtime" scans initiated via the file system filter driver of the
anti-malware platform are NOT affected.

regards
Stefan

> On 2020-03-27 15:27, Stefan Kanthak wrote:
>> in September 2017, Microsoft relocated many executable files of Windows
>> Defender from the directory "%ProgramFiles%\Windows Defender\" to
>> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\" ...
>> Of special interest here is the IOfficeAntiVirus implementation ...
>> This interface is called by the attachment manager ...
>> "Thanks" to the environment variable specified in the registered path
>> "%ProgramData%\Microsoft\Windows Defender\platform\<version>\MpOav.dll",
>> an unprivileged user/attacker can provide an arbitrary DLL which is
>> then loaded and executed ...
>> ...
>> Vendor statement:
>> The MSRC assigned case 57439 to the above report, and replied with the
>> following statements:
>> | After investigation, our engineers have determine this this behavior
>> | is by-design and does not constitute as a vulnerability as reported.
>> ...

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives