Re: Defense in depth -- the Microsoft way (part 64): Windows Defender loads and exeutes arbitrary DLLs

["Stefan Kanthak" <stefan.kanthak () nexgo de>]

"Paul Szabo" <paul.szabo () sydney edu au> wrote:

> Does this mean that unprivileged users can defeat WindowsDefender,
> even when that is "enforced" by managers? Surely that would be a
> vulnerability! I am not knowledgeable about Windows management,
> but the pages
> https://docs.microsoft.com/en-us/configmgr/protect/deploy-use/endpoint-protection
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus
> suggest that enforcement of WindowsDefender is a supported feature.

Yes, partially: this vulnerability allows unprivileged users
a) to bypass "on-demand" scans of files downloaded from the internet
   or other computers (which are initiated by the attachment manager),
b) to load an arbitrary DLL whenever a program calls the attachment
   manager or the IOfficeAntiVirus interface to initiate an "on-demand"
   scan;
"realtime" scans initiated via the file system filter driver of the
anti-malware platform are NOT affected.

regards
Stefan

> On 2020-03-27 15:27, Stefan Kanthak wrote:
> > in September 2017, Microsoft relocated many executable files of Windows
> > Defender from the directory "%ProgramFiles%\Windows Defender\" to
> > "%ProgramData%\Microsoft\Windows Defender\platform\<version>\" ...
> > Of special interest here is the IOfficeAntiVirus implementation ...
> > This interface is called by the attachment manager ...
> > "Thanks" to the environment variable specified in the registered path
> > "%ProgramData%\Microsoft\Windows Defender\platform\<version>\MpOav.dll",
> > an unprivileged user/attacker can provide an arbitrary DLL which is
> > then loaded and executed ...
> > ...
> > Vendor statement:
> > The MSRC assigned case 57439 to the above report, and replied with the
> > following statements:
> > | After investigation, our engineers have determine this this behavior
> > | is by-design and does not constitute as a vulnerability as reported.
> > ...


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/