vendor:
Windows Defender
by:
Anonymous
9.8
CVSS
CRITICAL
Buffer Overflow
119
CWE
Product Name: Windows Defender
Affected Version From: Windows Defender 4.2.4
Affected Version To: Windows Defender 5.0
Patch Exists: Yes
Related CWE: CVE-2012-6706
CPE: a:microsoft:windows_defender
Metasploit:
https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2012-6706/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2012-6706/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2012-6706/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2012-6706/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2012-6706/
Other Scripts:
N/A
Platforms Tested: Windows
2020
Windows Defender Vulnerability
Windows Defender inspects a variety of different archive formats, among others RAR. Inspection of mpengine.dll revealed that the code responsible for processing RAR archives appears to be a forked and modified version of the original unrar code; given that it still processes the VMSF_UPCASE filter (which was removed in unrar 5.0), it seems that the code is derived from a version of unrar older or equal than 4.2.4. An attacker that can set PosR to be -2, and DataSize to 1, can cause a read past the end of the buffer, and a write to a negative offset.
Mitigation:
Update Windows Defender to the latest version.
