Microsoft Malware Protection Engine can be disabled via a specially crafted file

(LiveHacking.Com) – Microsoft has released a security advisory about a denial of service vulnerability with its Malware Protection Engine. According to Microsoft, if the Malware Protection Engine scans a specially crafted file then it can cause a denial of service condition. This means that an attacker who manages to exploit the vulnerability could stop the Microsoft Malware Protection Engine from monitoring the filesystem, until the specially crafted file is manually deleted and the service is restarted. During this time the PC is susceptible to infection by other malware.

To exploit the vulnerability an attacker would need to place a specially crafted file on the target PC. This could be achieved in one of several different ways including via a website, via email message, or in an Instant Messenger message. If the affected anti-malware software has real-time protection turned on (which is the default), then the Microsoft Malware Protection Engine will scan the file automatically, leading to exploitation of the vulnerability.

The Malware Protection Engine is used by a variety of Microsoft products including Windows Security Essentials and Windows Defender. Microsoft has rated the vulnerability as “Important,” but not “Critical.”

Microsoft has fixed the vulnerability and the engine will be updated automatically when your PC next updates its malware definitions. Because the fix is part of the “normal” malware updates then Microsoft won’t be issuing a Security Bulletin about the problem, nor will it feature in a future Patch Tuesday. Microsoft estimates that the built-in update mechanisms will apply the fix within 48 hours of the release, however the exact time frame depends on the software used, Internet connection, and infrastructure configuration.