Vulnerability Name:

CVE-2017-8536 (CCN-126536)

Assigned:2017-05-26
Published:2017-05-26
Updated:2020-04-09
Summary:The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-369
CWE-674
CWE-476
CWE-119
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2017-8536

Source: BID
Type: Third Party Advisory, VDB Entry
98708

Source: CCN
Type: BID-98708
Microsoft Malware Protection Engine CVE-2017-8536 Remote Denial of Service Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1038571

Source: XF
Type: UNKNOWN
ms-malware-cve20178536-dos(126536)

Source: CCN
Type: Microsoft Web site
Microsoft Security Update Guide

Source: CONFIRM
Type: Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8536

Source: EXPLOIT-DB
Type: Third Party Advisory, VDB Entry
42081

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:windows_defender:-:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_10:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_10:1511:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_10:1607:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_10:1703:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:microsoft:endpoint_protection:-:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2013:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:exchange_server:2016:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_endpoint_protection:-:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:forefront_endpoint_protection:2010:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:security_essentials:-:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:windows_intune_endpoint_protection:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:malware_protection_engine:1.1.13704.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft windows defender -
    microsoft windows 10 -
    microsoft windows 10 1511
    microsoft windows 10 1607
    microsoft windows 10 1703
    microsoft windows 7 - sp1
    microsoft windows 8.1 -
    microsoft windows rt 8.1 -
    microsoft windows server 2008 r2 sp1
    microsoft windows server 2008 r2 sp1
    microsoft windows server 2016 -
    microsoft endpoint protection -
    microsoft exchange server 2013 -
    microsoft exchange server 2016 -
    microsoft forefront endpoint protection -
    microsoft forefront endpoint protection 2010
    microsoft security essentials -
    microsoft system center endpoint protection -
    microsoft windows intune endpoint protection *
    microsoft malware protection engine 1.1.13704.0