# MA-405.062014: MyCERT Advisory - Microsoft Releases Security Advisory for Microsoft Malware Protection Engine

**Date:** 19 Jun 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-405.062014  
**Advisory ID:** MA-405.062014

---

**1.0    Introduction**
Microsoft has released a security advisory to address a vulnerability to the Microsoft Malware Protection Engine. Successful exploitation of the vulnerability could allow an attacker to cause a denial of service.
**2.0     Impact**
The vulnerability could allow denial of service if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the specially crafted file is manually removed and the service is restarted.
**3.0    List of Affected Products**
- Microsoft Forefront Client Security
- Microsoft Forefront Endpoint Protection 2010
- Microsoft Forefront Security for SharePoint Service Pack 3
- Microsoft System Center 2012 Endpoint Protection
- Microsoft System Center 2012 Endpoint Protection Service Pack 1
- Microsoft Malicious Software Removal Tool (Applies only to May 2014 or earlier versions)
- Microsoft Security Essentials
- Microsoft Security Essentials Pre-release
- Windows Defender for Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2
- Windows Defender for Windows RT and Windows RT 8.1
- Windows Defender for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2
- Windows Defender Offline
- Windows Intune Endpoint Protection
**4.0    Recommendation**
- **Verify that the update is installed**
> Users should verify the installed and downloaded Microsoft antimalware products is the latest version of the Microsoft Malware Protection Engine.
>
> Detail information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, please refer  :
> [Microsoft Knowledge Base Article 2510781](https://support.microsoft.com/kb/2510781).
> For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.10701.0 or later.
- **If necessary, install the update**
> Enterprise Administrators :
> Ensure to update management software is configured to automatically approve and distribute engine updates and new malware definitions.
> To verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.
>
> End-users :
> The affected software provide built-in mechanisms for the automatic detection and deployment of this update.
> This update will be applied within 48 hours of its availability.
> The exact time frame depends on the software used, Internet connection, and infrastructure configuration.
> End users that do not wish to wait can manually update their antimalware software.
> For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, please refer to [Microsoft Knowledge Base Article 2510781](https://support.microsoft.com/kb/2510781).
Users are recommended to perform the update immediately. All of the patches could be done almost automatically via the Windows Update application.
The how-to perform of the Windows Update is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#5d3e243f382f6464641d3e243f382f2e383e282f342924733024) or [[email protected]](/cdn-cgi/l/email-protection#44293d2721363004293d272136306a2b36236a293d)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
**5.0    References**
[1]    US-CERT: Microsoft Releases Security Advisory for Microsoft Malware Protection Engine, June 2014 [online], <https://www.us-cert.gov/ncas/current-activity/2014/06/17/Microsoft-Releases-Security-Advisory-Microsoft-Malware-Protection>
[2]    Microsoft Security Advisory 2974294, June 2014 [online], <https://technet.microsoft.com/library/security/2974294>
[3]    AusCERT: Microsoft Malware Protection Engine, June 2014 [online], <http://auscert.org.au/render.html?it=19938>