Microsoft Security Advisory (2491888)

Vulnerability in Microsoft Malware Protection Engine Could Allow Elevation of Privilege

Published: February 23, 2011

Version: 1.0

General Information

Executive Summary

Microsoft is releasing this security advisory to help ensure customers are aware that an update to the Microsoft Malware Protection Engine also addresses a security vulnerability reported to Microsoft. The update addresses a privately reported vulnerability that could allow elevation of privilege if the Microsoft Malware Protection Engine scans a system after an attacker with valid logon credentials has created a specially crafted registry key. An attacker who successfully exploited the vulnerability could gain the same user rights as the LocalSystem account. The vulnerability could not be exploited by anonymous users.
Since the Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products, the update to the Microsoft Malware Protection Engine is installed along with the updated malware definitions for the affected products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.
Typically, no action is required of enterprise administrators or end users to install this update, because the built-in mechanism for the automatic detection and deployment of this update will apply the update within the next 48 hours. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.

Top of section

Advisory Details

Issue References

For more information about this issue, see the following references:

References	Identification
CVE Reference	CVE-2011-0037
Last version of the Microsoft Malware Protection Engine affected by this vulnerability	Version 1.1.6502.0*
First version of the Microsoft Malware Protection Engine with this vulnerability addressed	Version 1.1.6603.0**

*This version is the last version of the Microsoft Malware Protection Engine that is affected by the vulnerability.
**If your version of the Microsoft Malware Protection Engine is equal to or greater than this version, then you are not affected by this vulnerability and do not need to take any further action. For more information on how to verify the engine version number that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.

Top of section

Affected Software and Severity Ratings

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, visit Microsoft Support Lifecycle.
The Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products. Depending upon which affected Microsoft anti-malware product is installed, this update may have different severity ratings. The following severity ratings assume the potential maximum impact of the vulnerability.
Affected Software

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Anti-malware Software	Microsoft Malware Protection Engine Vulnerability - CVE-2011-0037
Windows Live OneCare	Important Elevation of Privilege
Microsoft Security Essentials	Important Elevation of Privilege
Microsoft Windows Defender	Important Elevation of Privilege
Microsoft Forefront Client Security	Important Elevation of Privilege
Microsoft Forefront Endpoint Protection 2010	Important Elevation of Privilege
Microsoft Malicious Software Removal Tool	Important Elevation of Privilege

Non-Affected Software

Anti-malware Software
Microsoft Antigen for Exchange
Microsoft Antigen for SMTP Gateway
Forefront Protection 2010 for Exchange Server
Forefront Threat Management Gateway 2010
Microsoft Forefront Security for SharePoint
Forefront Security for Office Communications Server
Microsoft Standalone System Sweeper (part of Microsoft Diagnostics and Recovery Toolset)

Top of section

Exploitability Index

The following table provides an exploitability assessment of the vulnerability addressed in this advisory.
How do I use this table?
Use this table to learn about the likelihood of functioning exploit code being released within 30 days of this advisory release. You should review the assessment below, in accordance with your specific configuration, in order to prioritize your deployment. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.

Vulnerability Title	CVE ID	Exploitability Index Assessment	Key Notes
Microsoft Malware Protection Engine Vulnerability	CVE-2011-0037	1 - Consistent exploit code likely	This is an elevation of privilege vulnerability

Top of section

Frequently Asked Questions (FAQ) About this Advisory

Is Microsoft releasing a Security Bulletin to address this vulnerability?
No. Microsoft is releasing this informational security advisory to help ensure customers are aware that this Microsoft Malware Protection Engine update also addresses a security vulnerability reported to Microsoft.
Typically, no action is required of enterprise administrators or end users to install this update.
Why is typically no action required to install this update?
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, anti-malware software must be kept up to date with these updates in a timely manner.
For enterprise deployments as well as end users, the default configuration in Microsoft anti-malware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.
Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.
How often are the Microsoft Malware Protection Engine and malware definitions updated?
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.
Depending on which Microsoft anti-malware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.
How can I install the update?
Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly.
For more information on installing the latest definitions, visit the Microsoft Malware Protection Center, or refer to your product documentation.
For end users, no further action is required because this security update will be downloaded and installed automatically through automatic updating or through their anti-malware software. For information on how to configure anti-malware software, refer to your product documentation.
For end users who want to install this update manually, refer to the following table.
Note Updates available through Microsoft Update will be listed as Important. Look for the appropriate update for your software with a name similar to the example listed in parenthesis () in the table below.

Software	Update Mechanism	Other methods of updating
Microsoft Security Essentials	Microsoft Update	How to manually download the latest definition updates for Microsoft Security Essentials
Microsoft Windows Defender	Windows Update	Install the latest Windows Defender definition updates
Microsoft Forefront Client Security	Microsoft Update	Install the latest Microsoft Forefront Security definition updates
Microsoft Forefront Endpoint Protection 2010	Microsoft Update (Example: "Definition Update for Microsoft Forefront Endpoint Protection 2010")	Install the latest Microsoft Forefront Security definition updates
Microsoft Malicious Software Removal Tool	Available on Tuesday, March 8, 2011	(None)

Note For additional information about deployment of this update for specific Microsoft anti-malware products, refer to Microsoft Knowledge Base Article 2510781.
What is the Microsoft Malware Protection Engine?
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software. For more information, see the section, Microsoft Malware Protection Engine Deployment, later in this advisory.
Where can I find more information about Microsoft anti-malware technology?
For more information, visit the Microsoft Malware Protection Center Web site.
Why is ISA Server not listed in the affected or non-affected software list?
While Microsoft Internet Security and Acceleration (ISA) Server is the predecessor of Forefront Threat Management Gateway 2010 (TMG), ISA Server does not contain the Microsoft Malware Protection Engine and as such is not considered in this advisory. Malware Scanning using the Microsoft Malware Protection Engine was first introduced in Forefront TMG. For more information about new features in Forefront TMG, see the Forefront Threat Management Gateway 2010 page, What's New.
Why is no update for the Malicious Software Removal Tool (MSRT) available at this time?
The vulnerability can only be exploited through the MSRT when MSRT is offered and downloaded using Automatic Updates, upon which time MSRT runs only once. An attacker cannot exploit this vulnerability by running the MSRT manually. Microsoft is planning to release an updated version to address the issue in the Malicious Software Removal Tool on Tuesday, March 8, 2011.

Top of section

FAQ for Microsoft Malware Protection Engine Vulnerability - CVE-2011-0037

What is the scope of the vulnerability?
This is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
What causes the vulnerability?
The vulnerability is caused when the Microsoft Malware Protection Engine fails to properly process a registry key that an attacker has set to a specially crafted value.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take complete control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
What is the LocalSystem account?
The LocalSystem account is a predefined local account used by the service control manager. It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. A service that runs in the context of the LocalSystem account inherits the security context of the Service Control Manager. Most services do not need such a high privilege level. For more information, see the MSDN article, LocalSystem Account.
How could an attacker exploit the vulnerability?
This vulnerability requires that a specially crafted registry location be scanned by an affected version of the Microsoft Malware Protection Engine. To exploit this vulnerability, an attacker would first have to log on to the system, and then set a user registry key to a specially crafted value.
If the affected anti-malware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan the location automatically, leading to exploitation of the vulnerability and allowing the attacker to take complete control of the affected system. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited and to take complete control of the affected system. An attacker could not exploit the vulnerability by initiating a scan manually.
In addition, exploitation of the vulnerability could occur when the system is scanned using an affected version of the Malicious Software Removal Tool (MSRT). However, if the current version of the MSRT has already run on the system, an attacker could not use the MSRT to exploit this vulnerability.
What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk. Servers could be at more risk if users who do not have sufficient administrative permissions are given the ability to log on to servers and to run programs. However, best practices strongly discourage allowing this.
What does the update do?
The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine processes values read from the registry.
When this security advisory was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.
When this security advisory was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued.

Top of section

Mitigating Factors and Suggested Actions

Mitigating Factors

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of this issue. The following mitigating factors may be helpful in your situation:

•	An attacker must have valid logon credentials to exploit this vulnerability. The vulnerability could not be exploited by anonymous users.
•	An attacker could use the Malicious Software Removal Tool (MSRT) to exploit this vulnerability only if MSRT has not already run on the system. For the majority of end users, the current version of the MSRT will already have downloaded and run automatically through automatic updating.

Top of section

Suggested Actions

There is typically no action required for enterprise administrators or end users to install this update. Microsoft recommends that customers keep malware definitions up to date at all times. Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft anti-malware products.
Administrators of enterprise anti-malware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.
For end-users, the affected software provide built-in mechanisms for the automatic detection and deployment of this update. For these customers the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration. End users that do not wish to wait can manually update their anti-malware software.
For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to Microsoft Knowledge Base Article 2510781, or refer to the section, Frequently Asked Questions (FAQ) About this Advisory.

Top of section

Top of section

Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

•	Cesar Cerrudo of Argeniss for reporting the Microsoft Malware Protection Engine Vulnerability (CVE-2011-0037)

Top of section

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections Web sites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Top of section

Feedback

•	You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Top of section

Support

•	Customers in the United States and Canada can receive technical support from Security Support. For more information about available support options, see Microsoft Help and Support.
•	International customers can receive support from their local Microsoft subsidiaries. For more information about how to contact Microsoft for international support issues, visit International Support.
•	Microsoft TechNet Security provides additional information about security in Microsoft products.

Top of section

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Top of section

Revisions

•	V1.0 (February 23, 2011): Advisory published. - wong chee tat :)

S$3b project to revive fading CBD

S$3b project to revive fading CBD
By Jo-ann Huang | Posted: 23 February 2011 2230 hrs

SINGAPORE: Property developer Guocoland's latest Tanjong Pagar project holds a new promise for the fading business district that has been overshadowed by the brand new Marina Bay area, home to the swanky Marina Bay Financial Centre.

The S$3 billion project will have more than 500,000 square feet of residential space.

It will also have more than one million square feet of office space.

Analysts expect keen investment interest in the project once it's ready in four to five years.

Guocoland chairman Sat Pal Khattar said the project, which features first-class office and residential buildings, hotels, and leisure facilities, has potential.

"People will live here and work here, and be involved with all the other activities," Mr Khattar said.

World-renowned architects Skidmore, Owings & Merrill and Architect 6 will design the project, which currently does not have a name.

Guocoland's 78-storey project will be one of the tallest buildings in the CBD.

It will also house one of the biggest apartment complexes in Tanjong Pagar, at 509,000 square feet.

This is second only to United Industrial Corporation's 927,000 square feet new development, where 60 per cent or 556,000 square feet of space will be allocated for residential units.

Median rentals for housing units in the area increased 10 per cent in 2010.

And they look set to rise now that Tanjong Pagar is becoming a choice destination to work, live and play.

Cushman & Wakefield vice chairman Donald Han said: "(The residential units) will be proper one-, two- or three-bedroom penthouse units; it might mirror the size of the Sail, for instance.

"Any development which is iconic in nature, located (near an) MRT station, (and) offers excellent views especially on the higher floors will be (sold) fairly well, and we will expect the end pricing to exceed the S$2,000 per square foot mark easily".

If economic growth remains robust at four to six per cent a year, analysts say occupancy for Guocoland's project could be between 80 and 100 per cent.

Mr Han said: "If you are looking from now till 2015 or 2016, in line with the new sites that will be triggered or developed by commercial developers, we will probably see a consistent two to 2.5 million square feet on a per annum basis.

"And that's enough to be... absorbed by the market. So we don't have any major inequilibrium in terms of the potential supply that will be coming into the market place".

Office rents in the CBD area rose 16.5 per cent last year.

Analysts said with strong demand from financial services firms, office rents in the CBD are expected to increase further.

Guocoland won the tender for the Tanjong Pagar site, which is also a white site, in November last year.

The site sits on Tanjong Pagar MRT station and was bought for S$1.7 billion dollars, and has a site area of 161,703 square feet and a gross floor area of 1,697,892 square feet.

Guocoland is owned by Malaysian tycoon Quek Leng Chan and its Singapore portfolio includes Sophia Residence and Goodwood Residence.

-CNA/wk

- wong chee tat :)

HDB receives 19 bids for Bishan land parcel

HDB receives 19 bids for Bishan land parcel
Posted: 24 February 2011 1801 hrs

SINGAPORE : The Housing and Development Board (HDB) has received a total of 19 bids for the residential land parcel at Bishan Street 14 at the close of its tender on Thursday.

Bishan Residential Development submitted the highest bid of S$550.1 million for the site.

The 11,997 square metre land parcel is meant for condominium housing development and is being offered for sale on a 99-year lease.

It has a maximum gross floor area of about 58,786 square metres, which can yield an estimated 650 dwelling units.

The top bid of S$550.1 million for the land parcel translates to about S$9,358 per square metre per gross floor area.

The next highest bid of S$432.3 million came from Keppel Land Realty, followed by a S$427.8 million bid by MCC Land (Singapore).

Other tenderers included Qingdao Construction (Singapore), MCL Land, Allgreen Properties and Sim Lian Land.

The lowest bid of S$213 million was submitted by Leng Hoe Development.

The land parcel was launched for public tender on January 21.

HDB said it would evaluate the bids and announce the final tender results within the next two weeks.

- CNA/al

- wong chee tat :)