Has McAfee ENS provided any mitigation for Microsoft Security Advisory ADV200006?

[ReallyWhy]

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV200006

Thank you much!! 

[TiltedFish]

Also interested in this. we have customers asking.. Would be good to see a hips signature or at least kb article with mitigation suggestions for McAfee products. cheers.

[chealey]

Hi all

Thanks for posting on the Community.

I would like to request you to please refer the below KB Articles:

https://kc.mcafee.com/agent/index?page=content&id=KB55447

https://kc.mcafee.com/agent/index?page=content&id=KB92585

Coverage with HIPS and ENS is still currently under investigation with our Exploit Prevention Team. I would encourage you to raise a Service Request so we can keep you updated with the status of the investigation.

[ReallyWhy]

Thank you for the information on user-defined UDS. However I need to know if ENS has any mitigation. I submitted a service request and they advised it is currently being analyzed with the McAfee Labs team. I can update this post when I get additional info. Thanks!

[holzfuass]

are there any news for ens? could not find anything

[ReallyWhy]

What I learned from support is that McAfee Labs has created an ENS Expert Rule and will provide on a case by case basis. There is not a KB in the works for this expert rule. This generic rule detects and blocks the Type 1 Font Parsing Remote Code Execution Vulnerability   *Disclaimer* This rule might be false prone based on the customer environment and with usage of Third Party applications using OpenType font. Rule { Process { Include OBJECT_NAME { -v "**" } } Target { Match SECTION { Include OBJECT_NAME { -v "%windir%\\System32\\atmfd.dll" } Include OBJECT_NAME { -v "%windir%\\syswow64\\atmfd.dll" } } } }   For NSP, see KB92585. This outlines the UDS-HTTP: Adobe Type Manager Font Driver Out-of-Bounds Write Vulnerability

[Kenchee_etf]

Hello all.

Please refer to my post under:

https://community.mcafee.com/t5/Endpoint-Security-ENS/new-Windows-exploit-zero-day-in-the-Adobe-Type...

I hope this helps.

[holzfuass]

already opened a case and we received extradat and expert rule

thks, everything is fine