Microsoft fixes Malware Protection Engine bug

Microsoft has warned of an issue with its Malware Protection Engine that could give hackers admin-like control on local accounts.

The Malware Protection Engine is designed to limit the risk of attack and infection, and Microsoft is making customers aware of the issue and advising how to mitigate the fault.

Microsoft said in a security advisory that the vulnerability could allow an attacker with valid log-in credentials to gain the same rights as the LocalSystem account. The flaw cannot be exploited by anonymous users.

Enterprise administrators and security workers have nothing specific to do to fix the issue, and Microsoft explained that any definition and anti-malware engine updates should be approved and used accordingly.

"Typically, no action is required of enterprise administrators or end users to install this update, because the built-in mechanism for the automatic detection and deployment of this update will apply the update," reads the advisory.

"The exact time frame depends on the software used, internet connection and infrastructure configuration."

The vulnerability is rated 'important' on Windows Live OneCare, Microsoft Security Essentials, Microsoft Windows Defender, Microsoft Forefront Client Security, Microsoft Forefront Endpoint Protection 2010, and the Microsoft Malicious Software Removal Tool.

The software's built-in update mechanism should deploy the fix in the next two days.