All versions of Windows are prone to critical unpatched remote code execution (RCE) vulnerabilities. Microsoft is currently working on a solution which should be deployed as part of next month’s Patch Tuesday.
For Windows 7 users, patches will be available only to those who have paid for ESU license. Until then, Windows users and administrators can apply a workaround to avoid any active exploits.
Where Do the RCE Vulnerabilities Originate from?
The issues come from the Windows Adobe Type Manager Library, and are related to the parsing of fonts.
According to the official Microsoft advisory, the company is “aware of limited targeted attacks that could leverage unpatched vulnerabilities in Adobe Type Manager Library.”
More specifically, two remote code execution flaws exist in Microsoft Windows, under the condition that the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font – Adobe Type 1 PostScript format.
The flaws can be exploited in various attack scenarios. A trivial scenario is convincing a user to open a specifically crafted document or viewing it in the Windows Preview pane.
As already mentioned, Microsoft is working on a solution, which should be released on Update Tuesday, the second Tuesday of each month. “This predictable schedule allows for partner quality assurance and IT planning, which helps maintain the Windows ecosystem as a reliable, secure choice for our customers,” the advisory says.
The Workarounds
Unfortunately, despite being a temporary solution, the available workarounds could have side-effects. If applied, Windows will not be able to preview OTF fonts, and WebDAV requests will not be transmitted.
“Disabling the Preview and Details panes in Windows Explorer prevents the automatic display of OTF fonts in Windows Explorer. While this prevents malicious files from being viewed in Windows Explorer, it does not prevent a local, authenticated user from running a specially crafted program to exploit this vulnerability,” Microsoft also notes.
Related: Microsoft Won’t Stop Nagging Users, Even After 1 Billion Devices Purpose Accomplished
