Home / exploitsPDF  

Microsoft Security Essentials Code Execution

Posted on 06 May 2013

Hi @ll,

versions of Microsoft Security Essentials before the current
v4.2 (see <https://support.microsoft.com/kb/2805304>) have a
vulnerability that could lead to execution of arbitrary code
in the security context of the LocalSystem account (almost like
<https://support.microsoft.com/kb/2781197> alias
<http://technet.microsoft.com/security/bulletin/ms13-034>).

The "UninstallString" written to

[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstallMicrosoft Security Client]
"UninstallString"="C:\Program Files\Microsoft Security Client\Setup.exe /X"

contains unquoted spaces.
This command may be called by Windows Update Agent or deployment
agents running under the LocalSystem account.

Timeline:
~~~~~~~~~

2012-12-05 vendor informed

2013-12-06 vendor acknowledged report

2013-02-13 vendor released fixed version

Stefan Kanthak

 

TOP

Malware :

Exploits :