An update to Microsoft Defender for Endpoint has temporarily left Linux servers unprotected after being applied, highlighting potential security vulnerabilities before a corrective patch was issued.
Defender Update Causes Security Gaps
The problem affected Linux server builds numbered 101.26042.0000 to 101.26042.0009, where the antivirus service could become inactive post-upgrade and reboot, thus exposing systems to potential threats.
Administrators reported on forums that after a scheduled patch and reboot, the service known as mdatp, particularly on version 101.26042.0009, failed to restart, leading to urgent troubleshooting efforts.
Microsoft’s Response and Resolution
In response, Microsoft withdrew the flawed builds from all supported Linux distributions, ensuring they were no longer accessible for new installations. The company then released version 101.26042.0011 to address the issue.
Users of the affected versions, as well as those on older releases, are advised to immediately upgrade to this new build to maintain their systems’ security integrity.
Ensuring Continuous Protection
System administrators are urged to confirm the health of their Defender installations rather than assuming an upgrade has resolved the problem, as the service might remain silently inactive even after updates.
Linux servers are critical for many businesses, often lacking the extensive visibility features present in Windows environments, making constant monitoring of agent health imperative.
It is advised to check each Linux endpoint using mdatp health commands to ensure they are updated to the corrected build version 101.26042.0011 or later, and cross-reference with the Microsoft Defender portal’s reports to verify active antivirus protection.
Importance of Post-Update Verification
This incident occurs amidst Microsoft’s ongoing efforts to refine how updates are delivered, including separating Windows EDR sensor updates from regular OS patches. While these changes aim for quicker updates, the recent bug underlines the necessity of rigorous post-update checks.
Organizations must prioritize verifying the health of their mixed-OS endpoint fleets post-update to safeguard against regression risks, ensuring their security posture remains robust.
