HTTP: Microsoft Malware Protection Engine CVE-2017-8540 Remote Code Execution
This signature detects attempts to exploit a known vulnerability against Microsoft Malware Protection Engine. A successful attack can lead to arbitrary code execution.
Extended Description
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
Affected Products
Microsoft system_center_endpoint_protection
Short Name
HTTP:STC:SCRIPT:CVE-2017-8540
Severity
Critical
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
CVE-2017-8540 Code Engine Execution Malware Microsoft Protection Remote bid:98703
Release Date
03/24/2020
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3727
False Positive
Unknown
Vendors
Microsoft
CVSS Score
9.3