From 58f4978b31111806699b1b75cbe67ca574a5acb2 Mon Sep 17 00:00:00 2001 From: John Tobin Date: Tue, 25 Jul 2017 14:23:29 -0700 Subject: [PATCH] Update note on BGInfo to announce vulnerability fix --- .../device-guard/deploy-code-integrity-policies-steps.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 1f4eff567b..f10201a997 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -33,7 +33,7 @@ Members of the security community\* continuously collaborate with Mic Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent Application Whitelisting policies, including Device Guard: - bash.exe -- bginfo.exe +- bginfo.exe[1] - cdb.exe - csi.exe - dnx.exe @@ -42,14 +42,16 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - kd.exe - ntkd.exe - lxssmanager.dll -- msbuild.exe[1] +- msbuild.exe[2] - mshta.exe - ntsd.exe - rcsi.exe - system.management.automation.dll - windbg.exe -[1]If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you whitelist msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. +[1]A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here [BGInfo 4.22](https://docs.microsoft.com/en-us/sysinternals/downloads/bginfo). Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. + +[2]If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you whitelist msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. *Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people: