Microsoft has recently issued a security advisory to help ensure customers are aware that an update to the Microsoft Malware Protection Engine also addresses a security vulnerability reported to them.

According to user reports, when performing a virus scan, Microsoft’s Malware Protection Engine fails to process a specially crafted registry value correctly, enabling local attackers with restricted privileges to execute arbitrary code at system privilege level (privilege escalation). This attacker, in turn, could gain the same user rights as the LocalSystem account.

The Microsoft Malware Protection Engine is a part of several Microsoft anti-malware products that includes Microsoft Security Essentials (MSE), Windows Live OneCare, Windows Defender, Forefront Client Security and Forefront Endpoint Protection 2010 products as well as the Malicious Software Removal Tool.

Microsoft advises that if your version of the Microsoft Malware Protection Engine is equal to or greater than version 1.1.6603.0, then you are not affected by this vulnerability and do not need to take any further action. If you want to know how to verify the engine version number that your software is currently using, you can see the section, “Verifying Update Installation”.

Currently, a patch that is being deployed automatically via the virus and signature update mechanism will fix the issue. Typically, no action is required of enterprise administrators or end users to install this update, because the built-in mechanism for the automatic detection and deployment of this update will apply the update within the next 48 hours. However, the exact time frame will of course depend on the software used, Internet connection, and infrastructure configuration.

An updated version of the Malicious Software Removal Tool will become available on 8 March. The tool is only vulnerable when it is first executed by the system after having been downloaded via Windows Update. Attackers can’t exploit the hole by manually starting the tool.