# MA-660.052017: MyCERT Advisory - Security Update for Microsoft Malware Protection Engine

**Date:** 12 May 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-660.052017  
**Advisory ID:** MA-660.052017

---

**1.0    Introduction**
Microsoft is releasing this security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft. The update addresses a vulnerability that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file.
**2.0    Impact**
An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system.
•    CVE-2017-0290: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0290>
**3.0 Affected Product**
- Microsoft Forefront Endpoint Protection 2010
- Microsoft Endpoint Protection
- Microsoft Forefront Security for SharePoint Service Pack 3
- Microsoft System Center Endpoint Protection
- Microsoft Security Essentials
- Windows Defender for Windows 7
- Windows Defender for Windows 8.1
- Windows Defender for Windows RT 8.1
- Windows Defender for Windows 10, Windows 10 1511, Windows 10 1607, Windows Server 2016, Windows 10 1703
- Windows Intune Endpoint Protection
**4.0 Recommendations**
MyCERT recommends users to review the information provided on the URL below and apply necessary update.
•    <https://technet.microsoft.com/en-us/library/security/4022344>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#5d3e243f382f6464641d3e243f382f2e383e282f342924733024) or [[email protected]](/cdn-cgi/l/email-protection#98f5e1fbfdeaecd8f5e1fbfdeaecb6f7eaffb6f5e1) â€¨
Phone: 1-300-88-2999 (monitored during business hours)â€¨
Fax: +603 89453442 â€¨
Mobile: +60 19 2665850 (24x7 call incident reporting)
â€¨SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888â€¨
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYTâ€¨
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
•    <https://technet.microsoft.com/en-us/library/security/4022344>
•    <https://threatpost.com/emergency-update-patches-zero-day-in-microsoft-malware-protection-engine/125529/>
•    <https://krebsonsecurity.com/2017/05/emergency-fix-for-windows-anti-malware-flaw-leads-mays-patch-tuesday/>
•    <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0290>