CVE-2023-33156: Microsoft Defender Elevation of Privilege Vulnerability

Overview

Severity
Medium (CVSS 6.3)
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Jul
Released
2023-07-11
EPSS Score
0.07% (percentile: 20.9%)

FAQ

References Identification Last version of the Microsoft Malware Protection Platform affected by this vulnerability Version 1.1.20300.3 First version of the Microsoft Malware Protection Platform with this vulnerability addressed Version 1.1.23050.3 See Manage Updates Baselines Microsoft Defender Antivirus for more information. Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue? Vulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state. Why is no action required to install this update? In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Platform. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner. For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Platform are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating. Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Platform updates and malware definitions, is working as expected in their environment. How often are the Microsoft Malware Protection Platform and malware definitions updated? Microsoft typically releases an update for the Microsoft Malware Protection Platform once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed. Depending on which Microsoft anti

Affected Products (1)

System Center

  • Microsoft Malware Protection Engine

Acknowledgments

Abdelhamid Naceri

Revision History

  • 2023-07-11: Information published.