Sikkerhetsoppdatering For Mac
Global Nav Open Menu Global Nav Close Menu; Apple; Shopping Bag.
For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.
For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.
Where possible, CVE IDs are used to reference the vulnerabilities for further information.
To learn about other security updates, see Apple security updates.
OS X El Capitan v10.11.5 and Security Update 2016-003
AMD
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1792 : beist and ABH of BoB
AMD
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later
Impact: An application may be able to determine kernel memory layout
Description: An issue existed that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2016-1791 : daybreaker of Minionz
apache_mod_php
Available for: OS X El Capitan v10.11 and later
Impact: Multiple vulnerabilities in PHP
Description: Multiple vulnerabilities existed in PHP versions prior to 5.5.34. These were addressed by updating PHP to version 5.5.34.
CVE-ID
CVE-2015-8865
CVE-2016-3141
CVE-2016-3142
CVE-2016-4070
CVE-2016-4071
CVE-2016-4072
CVE-2016-4073
AppleGraphicsControl
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A null pointer dereference was addressed through improved validation.
CVE-ID
CVE-2016-1793 : Ian Beer of Google Project Zero
CVE-2016-1794 : Ian Beer of Google Project Zero
AppleGraphicsPowerManagement
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1795 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro
ATS
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to leak sensitive user information
Description: An out of bounds memory access issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1796 : lokihardt working with Trend Micro's Zero Day Initiative
ATS
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: An issue existed in the sandbox policy. This was addressed by sandboxing FontValidator.
CVE-ID
CVE-2016-1797 : lokihardt working with Trend Micro's Zero Day Initiative
Audio
Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later
Impact: An application may be able to cause a denial of service
Description: A null pointer dereference was addressed through improved validation.
CVE-ID
CVE-2016-1798 : Juwei Lin of TrendMicro
Audio
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved input validation.
CVE-ID
CVE-2016-1799 : Juwei Lin of TrendMicro
Captive Network Assistant
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later
Impact: An attacker in a privileged network position may be able to execute arbitrary code with user assistance
Description: A custom URL scheme handling issue was addressed through improved input validation.
CVE-ID
CVE-2016-1800 : Apple
CFNetwork Proxies
Available for: OS X El Capitan v10.11 and later
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: An information leak existed in the handling of HTTP and HTTPS requests. This issue was addressed through improved URL handling.
CVE-ID
CVE-2016-1801 : Alex Chapman and Paul Stone of Context Information Security
CommonCrypto
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to leak sensitive user information
Description: An issue existed in the handling of return values in CCCrypt. This issue was addressed through improved key length management.
CVE-ID
CVE-2016-1802 : Klaus Rodewig
CoreCapture
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A null pointer dereference was addressed through improved validation.
CVE-ID
CVE-2016-1803 : Ian Beer of Google Project Zero, daybreaker working with Trend Micro’s Zero Day Initiative
CoreStorage
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A configuration issue was addressed through additional restrictions.
CVE-ID
CVE-2016-1805 : Stefan Esser
Crash Reporter
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with root privileges
Description: A configuration issue was addressed through additional restrictions.
CVE-ID
2.Platform – Linux/macOS/Solaris/WindowsFirst Released – 2012Codenvy is a commercial Java IDE built on top of the Eclipse Che. Other powerful Java application development features offered by BlueJ include creating dynamic objects and scanning the code visually. Lightweight java ide for mac. There are a total of 3 variants of the IDE that Java programmers can choose among; developer, enterprise, and team.Codenvy is a cloud-based and on-demand developer workspace.
CVE-2016-1806 : lokihardt working with Trend Micro's Zero Day Initiative
Disk Images
Available for: OS X El Capitan v10.11 and later
Impact: A local attacker may be able to read kernel memory
Description: A race condition was addressed through improved locking.
CVE-ID
CVE-2016-1807 : Ian Beer of Google Project Zero
Disk Images
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue existed in the parsing of disk images. This issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1808 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro
Disk Utility
Available for: OS X El Capitan v10.11 and later
Impact: Disk Utility failed to compress and encrypt disk images
Description: Incorrect keys were being used to encrypt disk images. This issue was addressed by updating the encryption keys.
CVE-ID
CVE-2016-1809 : Ast A. Moore (@astamoore) and David Foster of TechSmartKids
Graphics Drivers
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1810 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro
ImageIO
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted image may lead to a denial of service
Description: A null pointer dereference was addressed through improved validation.
CVE-ID
CVE-2016-1811 : Lander Brandt (@landaire)
Intel Graphics Driver
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed through improved bounds checking.
CVE-ID
CVE-2016-1812 : Juwei Lin of TrendMicro
Intel Graphics Driver
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to determine kernel memory layout
Description: Multiple access issues were addressed through additional restrictions.
CVE-ID
CVE-2016-1860 : Brandon Azad and Qidan He (@flanker_hqd) from KeenLab, Tencent
CVE-2016-1862 : Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent
IOAcceleratorFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to cause a denial of service
Description: A null pointer dereference was addressed through improved locking.
CVE-ID
CVE-2016-1814 : Juwei Lin of TrendMicro
IOAcceleratorFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1815 : Liang Chen, Qidan He of KeenLab, Tencent working with Trend Micro's Zero Day Initiative
CVE-2016-1817 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro working with Trend Micro's Zero Day Initiative
CVE-2016-1818: Juwei Lin of TrendMicro, sweetchip@GRAYHASH working with Trend Micro’s Zero Day Initiative
CVE-2016-1819 : Ian Beer of Google Project Zero
Entry updated December 13, 2016
IOAcceleratorFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A null pointer dereference was addressed through improved validation.
CVE-ID
CVE-2016-1813 : Ian Beer of Google Project Zero
CVE-2016-1816 : Peter Pi (@heisecode) of Trend Micro and Juwei Lin of Trend Micro
IOAudioFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed with improved bounds checking.
CVE-ID
CVE-2016-1820 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro working with Trend Micro’s Zero Day Initiative
IOAudioFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A null pointer dereference was addressed through improved validation.
CVE-ID
CVE-2016-1821 : Ian Beer of Google Project Zero
IOFireWireFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1822 : CESG
IOHIDFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1823 : Ian Beer of Google Project Zero
CVE-2016-1824 : Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent
CVE-2016-4650 : Peter Pi of Trend Micro working with HPs Zero Day Initiative
IOHIDFamily
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1825 : Brandon Azad
Kernel
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1827 : Brandon Azad
CVE-2016-1828 : Brandon Azad
CVE-2016-1829 : CESG
CVE-2016-1830 : Brandon Azad
CVE-2016-1831 : Brandon Azad
Kernel
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: An integer overflow existed in dtrace. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2016-1826 : Ben Murphy working with Trend Micro’s Zero Day Initiative
libc
Available for: OS X El Capitan v10.11 and later
Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through improved input validation.
CVE-ID
CVE-2016-1832 : Karl Williamson
libxml2
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1833 : Mateusz Jurczyk
CVE-2016-1834 : Apple
CVE-2016-1835 : Wei Lei and Liu Yang of Nanyang Technological University
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological University
CVE-2016-1837 : Wei Lei and Liu Yang of Nanyang Technological University
CVE-2016-1838 : Mateusz Jurczyk
CVE-2016-1839 : Mateusz Jurczyk
CVE-2016-1840 : Kostya Serebryany
libxslt
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1841 : Sebastian Apelt
MapKit
Available for: OS X El Capitan v10.11 and later
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: Shared links were sent with HTTP rather than HTTPS. This was addressed by enabling HTTPS for shared links.
CVE-ID
CVE-2016-1842 : Richard Shupak (https://www.linkedin.com/in/rshupak)
Messages
Available for: OS X El Capitan v10.11 and later
Impact: A malicious server or user may be able to modify another user's contact list
Description: A validation issue existed in roster changes. This issue was addressed through improved validation of roster sets.
CVE-ID
CVE-2016-1844 : Thijs Alkemade of Computest
Messages
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to leak sensitive user information
Description: An encoding issue existed in filename parsing. This issue was addressed through improved filename encoding.
CVE-ID
CVE-2016-1843 : Heige (a.k.a. SuperHei) of Knownsec 404 Security Team [http://www.knownsec.com]
Multi-Touch
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1804 : Liang Chen, Yubin Fu, Marco Grassi of KeenLab, Tencent of Trend Micro's Zero Day Initiative
NVIDIA Graphics Drivers
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1846 : Ian Beer of Google Project Zero
CVE-2016-1861 : Ian Beer of Google Project Zero
OpenGL
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 and later
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-ID
CVE-2016-1847 : Tongbo Luo and Bo Qu of Palo Alto Networks
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1848 : Francis Provencher from COSIG
SceneKit
Available for: OS X El Capitan v10.11 and later
Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through improved memory handling.
CVE-ID
CVE-2016-1850 : Tyler Bohan of Cisco Talos
Screen Lock
Available for: OS X El Capitan v10.11 and later
Impact: A person with physical access to a computer may be able to reset an expired password from the lock screen
Description: An issue existed in the management of password profiles. This issue was addressed through improved password reset handling.
CVE-ID
CVE-2016-1851 : an anonymous researcher
Tcl
How to turn off autocorrect of 1st in microsoft outlook for mac 2016. Disable autocorrect in Microsoft Outlook. In Outlook, you can turn off the autocorrect function as follows. Click File Options in outlook 2010 and 2013. In Outlook 2007, please click Tools Options. In the Outlook Options dialog box of Outlook 2010 and 2013, please click Mail in the left pane, then click the Spelling and Autocorrect. Turn AutoCorrect on or off in Outlook Outlook for Office 365 Outlook for Office 365 for Mac Outlook 2019 Outlook 2016 Outlook 2013 Outlook 2010 Outlook 2016 for Mac Outlook 2019 for Mac Outlook Web App More. Tech support scams are an industry-wide issue where scammers trick you into paying for unnecessary technical support services. You can help protect yourself from scammers by verifying that the contact is a Microsoft Agent or Microsoft Employee and that the phone number is an official Microsoft global customer service number. Does the Autocorrect feature in Microsoft Outlook 2019 or 2016 bother you? Or maybe you need it because you are a bad speller. You can turn Autocorrect on or off using these steps. From Outlook, select “File” “Options“. Select “Mail” on the left pane, then choose “Spelling and Autocorrect” button.
Available for: OS X El Capitan v10.11 and later
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: A protocol security issue was addressed by disabling SSLv2.
CVE-ID
CVE-2016-1853 : researchers at Tel Aviv University, Münster University of Applied Sciences, Ruhr University Bochum, the University of Pennsylvania, the Hashcat project, the University of Michigan, Two Sigma, Google, and the OpenSSL project: Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt
OS X El Capitan v10.11.5 includes the security content of Safari 9.1.1.
-->Vulnerability in Microsoft Malware Protection Engine Could Allow Denial of Service
Published: June 17, 2014
Version: 1.0
General Information
Executive Summary
Microsoft is releasing this security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft. The vulnerability could allow denial of service if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the specially crafted file is manually removed and the service is restarted.
The Microsoft Malware Protection Engine ships with several Microsoft antimalware products. See the Affected Software section for a list of affected products. Updates to the Microsoft Malware Protection Engine are installed along with the updated malware definitions for the affected products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.
Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.
Advisory Details
Issue References
For more information about this issue, see the following references:
References | Identification |
|---|---|
CVE Reference | |
Last version of the Microsoft Malware Protection Engine affected by this vulnerability | Version 1.1.10600.0 |
First version of the Microsoft Malware Protection Engine with this vulnerability addressed | Version 1.1.10701.0* |
Affected Software
This advisory discusses the following software.
Affected Software
| Vulnerability Severity Rating and Maximum Security Impact by Affected Software | |
| Antimalware Software | Denial of Service Vulnerability in Microsoft Malware Protection Engine- CVE-2014-2779 |
| Microsoft Forefront Client Security | Important Denial of Service |
| Microsoft Forefront Endpoint Protection 2010 | Important Denial of Service |
| Microsoft Forefront Security for SharePoint Service Pack 3 | Important Denial of Service |
| Microsoft System Center 2012 Endpoint Protection | Important Denial of Service |
| Microsoft System Center 2012 Endpoint Protection Service Pack 1 | Important Denial of Service |
| Microsoft Malicious Software Removal Tool[1] | Important Denial of Service |
| Microsoft Security Essentials | Important Denial of Service |
| Microsoft Security Essentials Prerelease | Important Denial of Service |
| Windows Defender for Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2 | Important Denial of Service |
| Windows Defender for Windows RT and Windows RT 8.1 | Important Denial of Service |
| Windows Defender for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 | Important Denial of Service |
| Windows Defender Offline | Important Denial of Service |
| Windows Intune Endpoint Protection | Important Denial of Service |
[1]Applies only to May 2014 or earlier versions of the Microsoft Malicious Software Removal Tool.
Non-Affected Software
Antimalware Software |
Does not run Malware Protection Engine |
Microsoft Forefront Server Security Management Console |
Microsoft Internet Security and Acceleration (ISA) Server |
Exploitability Index
The following table provides an exploitability assessment of the vulnerability addressed in this advisory.
How do I use this table?
Use this table to learn about the likelihood of functioning exploit code being released within 30 days of this advisory release. You should review the assessment below, in accordance with your specific configuration, in order to prioritize your deployment. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.
Vulnerability Title | CVE ID | Exploitability Assessment for Latest Software Release | Exploitability Assessment for Older Software Release | Denial of Service Exploitability Assessment | Key Notes |
Denial of Service Vulnerability in Microsoft Malware Protection Engine | 3 - Exploit code unlikely | 3 - Exploit code unlikely | Permanent | This is a denial of service vulnerability. |
Advisory FAQ
Is Microsoft releasing a Security Bulletin to address this vulnerability?
No. Microsoft is releasing this informational security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft.
Typically, no action is required of enterprise administrators or end users to install this update.
Why is typically no action required to install this update?
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.
For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.
Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.
How often are the Microsoft Malware Protection Engine and malware definitions updated?
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.
Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.
How can I install the update?
Refer to the section, Suggested Actions, for details on how to install this update.
What is the Microsoft Malware Protection Engine?
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.
Where can I find more information about Microsoft antimalware technology?
For more information, visit the Microsoft Malware Protection Center website.
FAQ for Denial of Service Vulnerability in Microsoft Malware Protection Engine- CVE-2014-2779
What is the scope of the vulnerability?
This is a denial of service vulnerability.
What causes the vulnerability?
The vulnerability is caused when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the specially crafted file is manually removed and the service is restarted.
How could an attacker exploit the vulnerability?
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.
If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited.
In addition, exploitation of the vulnerability could occur when the system is scanned using an affected version of the Malicious Software Removal Tool (MSRT).
What systems are primarily at risk from the vulnerability?
All systems running an affected version of antimalware software are primarily at risk.
What does the update do?
The update addresses the vulnerability by correcting how the Microsoft Malware Protection Engine scans specially crafted files.
When this security advisory was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.
When this security advisory was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued.
Suggested Actions
Verify that the update is installed
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.
For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, 'Verifying Update Installation', in Microsoft Knowledge Base Article 2510781.
For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.10701.0 or later.
If necessary, install the update
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.
For end-users, the affected software provide built-in mechanisms for the automatic detection and deployment of this update. For these customers the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. End users that do not wish to wait can manually update their antimalware software.
For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to Microsoft Knowledge Base Article 2510781.
Acknowledgments
Microsoft thanks the following for working with us to help protect customers:
- Tavis Ormandy of Google Project Zero for working with us on the Denial of Service Vulnerability in Microsoft Malware Protection Engine (CVE-2014-2779)
Other Information
Microsoft Active Protections Program (MAPP)
To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.
Feedback
- You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.
Support
- Customers in the United States and Canada can receive technical support from Security Support. For more information, see Microsoft Help and Support.
- International customers can receive support from their local Microsoft subsidiaries. For more information, see International Support.
- Microsoft TechNet Security provides additional information about security in Microsoft products.
Disclaimer
The information provided in this advisory is provided 'as is' without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions
- V1.0 (June 17, 2014): Advisory published.
Page generated 2014-07-07 10:25Z-07:00.