#microsoft

References Identification First version of the Microsoft Malware Protection Engine with this vulnerability addressed Version 1.1.18700.3 See Manage Updates Baselines Microsoft Defender Antivirus for more information. *Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue?* Vulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state. *Why is no action required to install this update?* In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner. For enterprise deployments as well as end users, the de...

*How Could an Attacker Exploit this Vulnerability?* A remote code execution vulnerability exists when a VM guest fails to properly handle communication on a VMBus channel. To exploit the vulnerability, an authenticated attacker could send a specially crafted communication on the VMBus channel from the guest VM to the Host. An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.

*Why is this OpenSSL Software Foundation CVE included in the Security Update Guide?* The vulnerability assigned to this CVE is in OpenSSL Software which is consumed by Microsoft Visual Studio. It is being documented in the Security Update Guide to announce that the latest builds of Visual Studio are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

**What is the attack vector for this vulnerability?** An attacker can write to any file where the webserver user (nt authority\\network service) has write access.

*How could an attacker exploit this vulnerability?* An authorized attacker could exploit this Windows COM vulnerability by sending from a user mode application specially crafted malicious COM traffic directed at the COM Server, which might lead to remote code execution.

*What can cause this vulnerability?* The vulnerability occurs due to improper validation of cmdlet arguments. *Does the attacker need to be in an authenticated role in the Exchange Server?* Yes, the attacker must be authenticated.

*What version of Azure Sphere has the update that protects from this vulnerability?* All versions of Azure Sphere that are 21.10 and higher are protected from this vulnerability. *How do I ensure my Azure Sphere device has the update?* If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.10 has been installed using the Azure Sphere CLI command: azsphere device show-os-version If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command: azsphere device show-deployment-status *Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?* An IoT device that is running Azure Sphere and is connecte...

*What version of Azure Sphere has the update that protects from this vulnerability?* All versions of Azure Sphere that are 21.10 and higher are protected from this vulnerability. *How do I ensure my Azure Sphere device has the update?* If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.10 has been installed using the Azure Sphere CLI command: azsphere device show-os-version If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command: azsphere device show-deployment-status *Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?* An IoT device that is running Azure Sphere and is connecte...

*What version of Azure Sphere has the update that protects from this vulnerability?* All versions of Azure Sphere that are 21.10 and higher are protected from this vulnerability. *How do I ensure my Azure Sphere device has the update?* If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.10 has been installed using the Azure Sphere CLI command: azsphere device show-os-version If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command: azsphere device show-deployment-status *Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?* An IoT device that is running Azure Sphere and is connecte...

*What version of Azure Sphere has the update that protects from this vulnerability?* All versions of Azure Sphere that are 21.10 and higher are protected from this vulnerability. *How do I ensure my Azure Sphere device has the update?* If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.10 has been installed using the Azure Sphere CLI command: azsphere device show-os-version If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command: azsphere device show-deployment-status *Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?* An IoT device that is running Azure Sphere and is connecte...