Microsoft Warns of Hackers Abusing Windows Adobe Library Zero-Days

guest · Mar 23, 2020

Microsoft Warns of Hackers Abusing Windows Adobe Library Zero-Days
March 23, 2020
https://www.bleepingcomputer.com/ne...kers-abusing-windows-adobe-library-zero-days/

Microsoft warned today of targeted attacks actively exploiting two zero-day remote code execution (RCE) vulnerabilities found in the Windows Adobe Type Manager Library and impacting all supported versions of Windows.

"Microsoft is aware of limited targeted attacks that could leverage un-patched vulnerabilities in the Adobe Type Manager Library, and is providing the following guidance to help reduce customer risk until the security update is released," the company says.
The two RCE security flaws exist in Microsoft Windows "when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format."

Microsoft has rated the vulnerabilities as Critical and says that they are impacting machines running desktop and server Windows releases, including Windows 10, Windows 8.1, Windows 7, and multiple versions of Windows Server.
Click to expand...

Microsoft is working on a fix
Microsoft says that a fix for the vulnerabilities is currently being developed and hints at a future release coming during next month's Patch Tuesday (on April 14).

Users of Windows 7, Windows Server 2008, or Windows Server 2008 R2 are required to have an ESU license to receive future security updates fixing these issues (more information here).
On Windows 10 devices successfully exploiting the two zero-day vulnerabilities will only lead to code execution with limited privileges and capabilities within an AppContainer sandbox context according to Microsoft's advisory.

However, attackers could still potentially install programs, view, change, or delete data, or even create new accounts with full user rights.
Click to expand...

Zero-days workarounds
To reduce the risks of attacks abusing these two zero-days, Microsoft advises customers to disable the Preview and Details panes in Windows Explorer to prevent the automatic display of OTF fonts.

"While this prevents malicious files from being viewed in Windows Explorer, it does not prevent a local, authenticated user from running a specially crafted program to exploit this vulnerability," Microsoft adds.
Click to expand...

Microsoft security advisory

Sampei Nihira · Mar 23, 2020

This vulnerability also affects Windows XP, Vista, Windows 7.
In Windows XP, the Webclient service must be disabled.
I have disabled this service for a long time, without any problems.

P.S.
I have now added third party remote fonts blocking to uBlock Origin.
It would be interesting to discuss whether this option is effective or not.

guest · Mar 23, 2020

Microsoft Windows Type 1 font parsing remote code execution vulnerabilities
Vulnerability Note VU#354840
March 23, 2020
https://kb.cert.org/vuls/id/354840/

Overview
Microsoft Windows contains two vulnerabilities in the parsing of Adobe Type 1 fonts, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Adobe Type Manager, which is provided by atmfd.dll, is a kernel module that is provided by Windows and provides support for OpenType fonts. Two vulnerabilities in the Microsoft Windows Adobe Type Manager library may allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system. This vulnerability affects all supported versions of Windows, as well as Windows 7. This vulnerability is being exploited in the wild.
Impact
By causing a Windows system to open a specially crafted document or view it in the Windows preview pane, an unauthenticated remote attacker may be able to execute arbitrary code with kernel privileges on a vulnerable system. Windows 10 based operating systems would execute the code with limited privileges, in an AppContainer sandbox.
Click to expand...

anon · Mar 25, 2020

Critical font parsing issue in Windows revealed (fix inside)
https://www.ghacks.net/2020/03/24/critical-font-parsing-issue-in-windows-revealed-fix-inside/

Sampei Nihira · Mar 28, 2020

If any users is interested, some tips on the vulnerability:

https://msfn.org/board/topic/181352-microsoft-warns-of-hackers-abusing-windows-adobe-library-zero-days/

Sampei Nihira · Mar 31, 2020

Interesting what you read in the blog of 0patch,the first and second of the mitigations recommended by Microsoft have the cons of:

https://blog.0patch.com/2020/03/micropatching-unknown-0days-in-windows.html

Cons: Other attack vectors remain open, such as malicious documents, or opening a malicious font file in Font Viewer.
Click to expand...

I tried to do a test, consider that I am in the Standard Account (Windows 10 1909).
I insert an image below:

as you can see I opened the prompt window not with Administrator rights.
I entered the command line:

fontview agencyr.ttf

this allows you to open the Font Viewer with that specific font.

Note that in Process Explorer, Font Viewer, has an IL to the medium value.

You can replicate the test by imagining that Font Viewer opens an Adobe Type 1 PostScript font.

guest · Apr 1, 2020

How to Mitigate the Windows Font Parsing Zero-Day Bug via GPO
April 1, 2020
https://www.bleepingcomputer.com/ne...he-windows-font-parsing-zero-day-bug-via-gpo/

Active Directory (AD) admins can mitigate the recently disclosed and actively exploited remote code execution (RCE) zero-day found in the Windows Adobe Type Manager Library in large AD environments using group policies.

Microsoft already shared a number of workarounds designed to block or reduce the risks behind attacks abusing these vulnerabilities, including disabling the Preview and Details panes in Windows Explorer, disabling the WebClient service, and renaming the vulnerable library (ATMFD.DLL).
However, Microsoft's workarounds aren't easy to implement to mitigate attacks in an enterprise AD environment.

To mass mitigate the issue on corporate devices running versions of Windows vulnerable to abuse, you can do it in one go with the help of group policies as Microsoft MVP Sylvain Cortes explained in a blog post.
Click to expand...

Log in or Sign up

Microsoft Warns of Hackers Abusing Windows Adobe Library Zero-Days

guest Guest

Sampei Nihira Registered Member

guest Guest

anon Registered Member

Sampei Nihira Registered Member

Sampei Nihira Registered Member

guest Guest

Log in or Sign up

Microsoft Warns of Hackers Abusing Windows Adobe Library Zero-Days

guest Guest

Sampei Nihira Registered Member

guest Guest

anon Registered Member

Sampei Nihira Registered Member

Sampei Nihira Registered Member

guest Guest

Useful Searches