CVE-2020-1163 for Windows Defender no fix?

Topic

New Reply

CVE-2020-1163

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1163

shows that it applies to Windows Defender on Windows 8.1, yet states about the antimalware client version

First version of MpCmdRun.exe with the vulnerability addressed is 4.18.2005.1

I’ve examined hundreds of Windows 8.1 Pro computers and they all have version 4.10.209.0, yet have automatically received the updated malware protection engine version 1.1.17700.5 that resolves the more recent CVE-2021-1647

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1647

Is Microsoft’s CVE-2020-1163 wrongly documented, or is there a way to get the version 4.18.2005.1 antimalware client that resolves this CVE for Windows 8.1?

Please let me know if I’m missing something here…

Reply | Quote

Replies

Are you checking the file version of MpCmdRun.exe or the antimalware client version in Defender?

The documentation is certainly confusing as it seems to refer to both of those in different places, but with the same recommended version number, whereas in practice they have different version numbers.

On Windows 10, I have MpCmdRun.exe 4.18.1909.6 (vulnerable?) but antimalware client 4.18.2011.6 (not vulnerable?)

Reply | Quote

I’m referring to both the About screen’s antimalware client version, and the actual file version.

Both MpCmdRun.exe and MsMpEng.exe executables have the same version, but on Windows 10 Microsoft has multiple versions installed in various directories.  There’s the “original” set of files in C:\Program Files\Windows Defender, with the oldest version numbers.  Then as Defender updates itself, it puts sets of newer files in C:\ProgramData\Microsoft\Windows Defender\Platform subdirectories named for the version of those newer files.  The “current” set of files is in the subdirectory with the newest versioned subdirectory.  You should find that the newest versioned subdirectory has an MpCmdRun.exe file with the version shown in the About screen as the antimalware client version.

Reply | Quote