CVE-2020-1170

FAQ

Why is no action required to install this update?

MpCmdRun.exe is part of the monthly Defender update package installed automatically without a need for machine reboot. See KB4052623: Update for Windows Defender antimalware platform

Customers should still check the Windows Defender antimalware client version to make sure the update is happening on their machine.

How often is the Windows Defender antimalware platform updated?

Microsoft typically releases an update for the Windows Defender antimalware platform once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.

Depending on which Microsoft antimalware software is used and how it is configured, the software may search for platform, engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.

What is MpCmdRun.exe?

MpCmdRun.exe is the Windows Defender command line utility executable used to automate Windows Defender tasks like scheduled scan, scheduled update, cleanup, verification, and maintenance.

Does this update contain any additional security-related changes to functionality?

Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.

Where can I find more information about Microsoft antimalware technology?

For more information, visit the Microsoft Malware Protection Center website.

Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue?

Vulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state.

Suggested Actions

Verify that the update is installed

Customers should verify that the latest version of the Windows Defender antimalware platform and definition updates are being actively downloaded and installed for their Microsoft antimalware products.

For more information on how to verify the version number for the Windows Defender antimalware platform that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781.

For affected software, verify that the Windows Defender antimalware platform version is 4.18.2005.1 or later.

If necessary, install the update

Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Windows Defender antimalware platform and definition updates are being actively downloaded, approved and deployed in their environment.

For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.

End users who do not wish to wait can manually update their antimalware software. For more information on how to manually update the Windows Defender antimalware platform and malware definitions, refer to Microsoft Knowledge Base Article 2510781.