On Monday, Microsoft released an advisory to inform users of a vulnerability affecting all supported versions of Windows, including Windows 10, Windows Server 2012, Windows Server 2016, and Windows Server 2019.
Microsoft is working on a fix for the vulnerabilities but did not provide a time frame on when the patch will be released. Or whether it will be available on patch-Tuesday or released as an out-of-band patch as it has for other zero-day exploits in the past. The next patch Tuesday is currently scheduled for April 14.
Microsoft simply stated the attacks are “limited” and “targeted” and to let the advisory server as a warning until a patch is released.
Microsoft has recommended the following workarounds until patch is released:
- Disabling the Preview Pane and Details Pane in Windows Explorer
- Disabling the WebClient service
- Renaming ATMFD.DLL
Additional Vulnerabilities with Windows 7 and Adobe Type Manager
Windows 7 is also affected by this vulnerability. A patch will be developed for Windows 7, however, unless a user subscribes to Windows 7 Extended Security Updates, they will not have access to the patch. See link at the bottom for more information on the Extended Security Update program.
The active attacks target a flaw in the Adobe Type Manager Library. Two remote code execution vulnerabilities exist in Windows when the Adobe Type Library Manager improperly handles a specially crafted multimaster font called Adobe Type 1 PostScript format.
The advisory states, “There are multiple ways an attacker could exploit the vulnerability, such as convincing a user to open a specially crafted document or viewing it in the Windows Preview pane.”
The advisory link from Microsoft can be found here:
Information about how to get patches for products in the Extended Security Update program can be found here:
Please reach out to Zunesis if you have any questions regarding this advisory or need help with implementing the workarounds. We are here to help in any way that we can.