15 ms·
Windows code-execution zeroday is under active exploit, Microsoft warns
- robocat 7y agoSome additional points from https://www.itnews.com.au/news/new-remote-code-execution-windows-zero-days-actively-exploited-539730 https://www.itnews.com.au/news/new-remote-code-execution-win... * Attackers can exploit the vulnerability by embedding the Type 1 fonts into documents and convincing users to open them * The vulnerabilities lies in the Windows Adobe Type Manager Library ATMFD.DLL * disabling the Windows WebClient service blocks what Microsoft says is the most likely remote attack vector, through the Web Distributed Authoring and Versioning (WebDAV) client service. * local, authenticated users can run malicous programs that can exploit the vulnerability (I presume this is a privilege escalation).
- afrcnc 7y agoor you can link to the actual MSFT advisory instead of all these articles rewording the same thing: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- ChrisSD 7y ago> For systems running supported versions of Windows 10 a successful attack could only result in code execution within an AppContainer sandbox context with limited privileges and capabilities. Which is still not good but not as bad as it could be.
- saagarjha 7y agoIsn't this code running in Windows Explorer? That sounds like it could potentially be pretty bad.
- WorldMaker 7y agoExplorer doesn't render arbitrary user selected fonts and Segoe UI is not a PostScript font, so I don't think Explorer itself uses this component at all? (A lot of Windows should be using DirectWrite now? I don't think DirectWrite uses this component either?) Also, the way this is written is sounds like system isolates this DLL into its own AppContainer separate from specific apps that use/rely on it (and I guess remote to it)?
- WorldMaker 7y agoI found answers to some of my questions on my own: - The AppContainers thing sounds like it directly refers to the Panes in Explorer referenced, and it sounds like it is Explorer creating the sandboxes, so they wouldn't bubble out of the Pane, so it probably is correct that versions of Windows 10 doing that don't have a lot to worry about that as an exploit vector. That probably doesn't apply to other possible vectors such as evil PDFs/Word Documents, though those generally have warnings for PostScript fonts at this point. (I glossed over the Panes as the concern for the idea it might be running in the Explorer process. Their an "extension point", so Explorer moving them into sandboxes sound like exactly what it should have done, and not surprising is what it is doing.) - DirectWrite is considered to have parts forked, but entirely independent, from ATMFD. Some CVEs have been caught that also impacted (lightly) DirectWrite, but this doesn't sound like one.
- kevingadd 7y agoAppContainers have nothing to do with panes, see here: https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation https://docs.microsoft.com/en-us/windows/win32/secauthz/appc... It's a sandboxing method, and atmfd was moved into a sandbox to reduce the risk of people exploiting bugs in it. At this point it is clear that sandboxing it was worth the effort.
- WorldMaker 7y agoFair, that link points out the Kernel hosts some sandboxes directly. I had assumed they mostly had to be opt-in at the application level (opt-out in the case of the UWP platform), given the name, and those Panes are open third-party extension points and it does seem like sandboxes should apply to anything running in them as well, so it seems a fair assumption to believe that is where they were applied.
- topspin 7y ago> Which is still not good but not as bad as it could be. Not great, not terrible. ...sorry
- miohtama 7y agoIt says Adobe... So there is a component from Adobe in the core windows? Or does the DLL come with a PDF reader installation?
- deleted 7y ago[deleted]
- kevingadd 7y agoIt's an adobe component in Windows to handle fonts because Adobe controls/controlled a big part of the font ecosystem. At this point I believe the Windows team controls it and can make changes to it, but it's definitely supporting adobe file formats
- WorldMaker 7y agoAs pointed out in other threads, it is a Microsoft component that (heavily) forked from purchased Adobe code somewhere around Windows 2000/XP.
- calibas 7y agoIt's needed for displaying Postscript Type 1 fonts. I believe Adobe owns the licensing for everything but it's up to Microsoft to update the Windows 10 DLL.
- SlowRobotAhead 7y ago> The security flaw exists in the Adobe... Imagine my surprise. Geez maybe it’s not the best idea to allow Adobe to entirely run the font game? Source: worked at Adobe years ago
- klingonopera 7y agoI imagine you're getting downvotes because of your smug hyperbole, but in essence, I wouldn't deny that that is a legit question (not the entire fontgame, I guess, but a core part of it anyway). It's also one of the reasons to reduce use of proprietary software to a minimum. Especially, if it's a core component of the system. Flatline, it's an increased security risk you can't verify. On a serious note: Are there legit reasons to have it being a core component?
- SlowRobotAhead 7y agoYea... worked at Adobe. It’s not smug hyperbole. That company doesn’t have any sort of culture of responsible coding. Without question one of the worst companies to be put in charge of anything important anywhere. That’s all I’ll say about Adobe. Dark times, glad I moved on.
- deleted 7y ago[deleted]
- jamesgeck0 7y agoDownvoted because Adobe hasn’t had anything to do with this code for like two decades.
- mrpippy 7y agoATMFD strikes again, and undoubtedly not for the last time. More info on the history of ATMFD (and some previous vulnerabilities): https://googleprojectzero.blogspot.com/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.com/2015/07/one-font-vuln...
- r00fus 7y agoIs there no way to simply remove this DLL or is it too widely used in core Windows?
- wolfi1 7y agoit is essential for the rendering of postscript fonts. there is no replacement for it, unfortunately
- jfk13 7y agoOn the other hand, many of us could probably live without any postscript fonts.
- wolfi1 7y agountil you open a pdf file
- jfk13 7y agoDepends on the PDFs you're interested in. Many use only embedded TrueType (Type42) fonts, which I assume are handled by the usual Microsoft renderer. (If you're reading lots of LaTeX-generated papers, then yes, you're probably seeing PostScript fonts.)
- blattimwind 7y agoThis is part of the huge and unending clusterfuck of vulnerabilities that people find in the Windows graphics stack, which was wisely moved to kernel space early on in NT's life, which makes all these vulnerabilities much more critical than they would be otherwise.
- wolfi1 7y agoMS should consider including the freetype library instead of Adobe's type manager
- jfk13 7y agoThe new(ish) CFF renderer in Freetype also comes from Adobe. I don't know whether it shares any code with what's in ATM, and if so, whether any vulnerability might be applicable to both, but it might be interesting for someone knowledgeable to investigate.
- Tempest1981 7y agoSomeone posted this comment in the arstechnica article: To be clear and despite its name, this is not Adobe code. Microsoft was given the source code for ATM Light for inclusion in Windows 2000/XP. After that, Microsoft took 100% responsibility for maintaining the code. Microsoft has added additional code and removed code from that DLL (they shove all their Type 1 handling and Open Type font format handling into that one DLL)
- jjtheblunt 7y ago“For systems running supported versions of Windows 10 a successful attack could only result in code execution within an AppContainer sandbox context with limited privileges and capabilities.”
- mike_d 7y agoAnyone running around actively exploiting a zero-day Windows font parsing exploit likely also has a sandbox escape exploit too.
- glofish 7y agoNo patch available but one of the recommended mitigations is to: Rename ATMFD.DLL would it be possible to have a patch that renames this file for me, if that is indeed a desirable and workable solution.
- rkagerer 7y agoIn the meantime: Right-click C:\Windows\System32\atmfd.dll Properties | Security | Advanced | Owner, take ownership. Close dialogs, go back in and give yourself Full Control. Now you can rename the file.
- bilegeek 7y agoWould renaming cause issues with Office 2016, perchance?
- jlgaddis 7y agoTry it and find out. You can always "undo" that change, if so.
- rkagerer 7y agoHaven't encountered any definitive ones yet. I renamed it, then used Outlook 2016 successfully for days (mostly Outlook, Word and some Excel). After a reboot, I did get an error code 0x426-0x0 trying to start office apps, but I'm pretty sure that was just due to disabling the Click-To-Run service a long time ago and (possibly) having gotten new updates pushed to me during the reboot. I did an SFC /SCANNOW which restored the original atmfd.dll, and I immediately deleted it. If you bump into any OpenType fonts it might be a different story.
- jliptzin 7y agoWhen has someone ever thought there wasn’t a Windows zeroday under active exploit?
- nabakin 7y agoNo one. They are adding emphasis.
- jacquesm 7y agoThe larger your kernel the bigger the chance that it will get hacked. This stuff should have never been in the kernel in the first place.
- swebs 7y agoAgain?
- ngneer 7y agovon Neumann saw that code is data. Now what? We like the power of computation too much to give it up, and yet cannot avoid the pitfalls of complex interpreters. Compartmentalize though we may, control is not easy to tame.
- blinkingled 7y ago> Elsewhere the advisory said: “For systems running supported versions of Windows 10 a successful attack could only result in code execution within an AppContainer sandbox context with limited privileges and capabilities.” https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv200006#ID0EMGAC https://portal.msrc.microsoft.com/en-us/security-guidance/ad... : Windows 10 1709+ All fonts are processed in fontdrvhost.exe in user mode appcontainer. ATMFD.DLL status: Not present
- hackersword 7y agoWhere is ATMFD.DLL ? I am not seeing that in c:\windows\system32\ATMFD.DLL in multiple different windows10 machines I've checked.
- unnouinceput 7y agothis is a mistake in article. atmfd.dll is for older version of windows. Windows 10 has it under name of ATMLIB.DLL. Search for that one instead and rename it.
- akeck 7y agoFrom above: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- unnouinceput 7y ago2 points: 1 - article has wrong info. Under Windows 10 the name is ATMLIB.DLL. ATMFD.DLL is the name for older version of Windows 2 - rename it. Here is the script to be used under an elevated command prompt (change name accordingly if Win10): cd "%windir%\system32" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll cd "%windir%\syswow64" takeown.exe /f atmfd.dll icacls.exe atmfd.dll /save atmfd.dll.acl icacls.exe atmfd.dll /grant Administrators:(F) rename atmfd.dll x-atmfd.dll
- asimops 7y agoPlease keep in mind that you need to localize 'Administrators' to make this work on non english systems. When deploying this, it would be better to replace the name with the groups sid. I am on mobile right now but some fellow hacker can surely provide them.
- unnouinceput 7y agoEnglish site with English news and English speaking commenters. Well, tell you what, when Alpha Centauri dudes will comment here to localize for them, that's when I'll do it.
- moepstar 7y agoLooking up your local Administrator name: wmic path win32_group where (LocalAccount=true AND SID="S-1-5-32-544") get Name edit: that's just the name of the local Administrators group, here's how to get the Admin-accountname: wmic useraccount where (domain='localhostname' and sid like 'S-1-5-21-%%-500') get sid /value wmic useraccount where (domain='localhostname' and sid='sidfromfirstcommandhere') get name /value
- Randor 7y agoHmmmm, That will just return the name of the built-in Administrators account. If you wanted to find all user accounts in the administrators group you could do: powershell -c "$([ADSI]'WinNT://YOUR_MACHINE_NAME/Administrators,group').psbase.Invoke('Members') | foreach { $_.GetType().InvokeMember('ADspath', 'GetProperty', $null, $_, $null)}"
- llcoolv 7y agoWhy do people still use this "OS" is beyond me.
- tbezman 7y agogaming
- Stratoscope 7y agoAnd almost the entire business world.
- afrcnc 7y agoenterprise sysadmins are just giant gamers
- jlgaddis 7y agoReally? I've never used Windows 10 and it's been years since I had a Windows machine on my desk but is it really that difficult to imagine and/or understand why ~90% of the world's PCs run Windows?
- lostmsu 7y agoX.org: https://www.cvedetails.com/cve/CVE-2018-14600/ https://www.cvedetails.com/cve/CVE-2018-14600/ MacOS: https://blog.talosintelligence.com/2016/07/apple-image-rce.html https://blog.talosintelligence.com/2016/07/apple-image-rce.h... What do you use?
- upofadown 7y agoThe X.org one is only technically RCE in practice as you need an authenticated connection to the X server. It is really more of a local privilege escalation for the case where the X server is running as root.
- dmix 7y ago> The second workaround—disabling the WebClient service—blocks the vector attackers would most likely use to wage remote exploits. Even with this measure in place, it’s still possible for remote attackers to run programs located on the targeted user’s computer or local network. Still, the workaround will cause users to be prompted for confirmation before opening arbitrary programs from the Internet. ... why doesn't WebClient also prompt users before opening programs via things from the internet then? It basically makes anything that calls an internet service in authenticated apps, like Windows Explorer's image preview pane, a vector for loading arbitrary programs without warning. Am I missing something here? Some way this would be really annoying or pointless? I know Android never bit the bullet with making any internet access require a privacy confirmation, which I'm guessing might be overwhelming to the average user. But I still think it should be an option, like an opt-in Little Snitch for network access that includes embedded webkits.
- voldacar 7y agoWhy should a kernel even have the slightest idea what a font is? this is absurd
- sb057 7y agohttps://stackoverflow.com/questions/28532190/why-does-windows-handle-scrollbars-in-kernel https://stackoverflow.com/questions/28532190/why-does-window...
- wintorez 7y agoThanks Microsoft!!
- paulie_a 7y agoIs there a search and destroy program that can 100 percent remove anything with even a hint of adobe code? Windows should banish adobe PDF from being utilized in the is and actively treat it as a virus. If it's zero day on Windows it is pretty much a guarantee that adobe or Oracle was involved
- peter_d_sherman 7y agoI've always wondered why fonts are rendered programmatically... Usually, font renderers are Turing complete in some way, and usually this opens up security concerns, and rightfully so... One of the primary reasons why fonts are rendered programmatically is because there's a theoretically infinite set of sizes/styles that might be required... Well... why not make fonts with glyphs that are say, 5000 x 5000 pixels... and then instead of rendering for a particular size, line by line, stroke by stroke, curve by curve, why not instead use an interpolation algorithm to shrink that 5000 x 5000 pixel glyph to the exact size you want? If a font provider program were made to operate that way, then all that would be needed to audit the program for security - would be to audit the shrinking/interpolation algorithm -- which could be as simple as possible (it's just a function which shrinks a bitmap of size A to another bitmap of size B... not a Turing machine which ingests other programs...) Yes, fonts would consume much more memory (I suppose they could be compressed), but doing things that way might make font-providing programs more secure. And yes, you'd need to provide extra glyphs for italic, bold, bold italic, etc. (much more memory), but you'd be making a trade-off for a simple, security auditable font-provider... (we assume it's open-source...)
- monadic2 7y ago> Usually, font renderers are Turing complete in some way, and usually this opens up security concerns, and rightfully so... Most of the features of which I am aware in fonts are modeled as FSMs, which can certainly be turing complete but do not need to be. Off the top of my head you could figure out a “sane” max time for a “script” to run without any loss of font quality, though it would not technically comply with the intended functionality. I am at a loss of words for why this was ever possible, although perhaps security didn’t matter until this past decade and I am too young to remember how low priority it used to be.... certainly, putting anything in kernel space for performance reasons of all things seems ridiculous for desktop computing. I’ll take a fucking massive performance hit to keep my data safer.
- beders 7y agoSlight correction: FSMs are not turing-complete. They may not hold though, which is not the same thing.
- nyanpasu64 7y agoCould web fonts (CSS font-face) allow exploitation by merely visiting a browser page?
- greggman3 7y agoI really wish (hope) that Microsoft is working on a brand new OS with a VM like thing for running legacy stuff (like Apple did with OS9 to OSX) They really do need to start over from scratch, get rid of all the cruft, design the APIs not to suck, design in security, permissions, and sandboxing from the beginning. Make root kits and other spyware much harder. Get rid of installation scripts (more like iOS/Android/Some Mac app) and a million other things. I don't hate windows but I hate that every app I install including every game on steam or the oculus store or humble bundle can basically own my machine.
- zvrba 7y ago> They really do need to start over from scratch, get rid of all the cruft, design the APIs not to suck, design in security, permissions, and sandboxing from the beginning. Security model is still better than what POSIX provides. As for sandboxing: "For systems running supported versions of Windows 10 a successful attack could only result in code execution within an AppContainer sandbox context with limited privileges and capabilities." From https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv200006#ID0EMGAC https://portal.msrc.microsoft.com/en-us/security-guidance/ad...
- MikusR 7y agoWindows 10x is exactly that.
- jfkebwjsbx 7y agoThey don't need to get rid of anything, and in fact they cannot. People want their current stuff. What they can add is sandboxed apps with a virtual filesystem and whatnot. But they do not want to spend the manpower to do so, it seems.
- contextfree 7y agothese were/are basically the goals of UWP and Windows Core/10X
- yread 7y agoIt is a good time for exploit (even the ones that can be patched) as people work from home and can't access enterprise WSUS servers to fetch updates
- pas 7y agoWin10 is supposed to be evergreen, aggressively auto-updating, etc. so how come there are years old versions around!? (Win10 1703+ is already not using this DLL, that came out years ago.)
- jfkebwjsbx 7y agoEvergreen? There is not much new in Windows 10, everything is based on the previous version.
- pas 7y agoEvergreen means always up-to-date like Chrome. Automatically downloads + applies updates.
- jfkebwjsbx 7y agoTIL. Thanks!
- lexicality 7y agoBecause idiots do everything they possibly can to stop their os updating
- BubRoss 7y agoWhen you have an OS that updates out from under you, takes 45 minutes to shutdown or start up, shuts down without your control etc. it's no wonder people want more control over their updates.
- lexicality 7y agoNot to be callous, but if your computer takes 45 minutes to restart you need to reinstall Windows because there's clearly something wrong with it.
- 7y ago
- 0x0 7y agoSo does this mean that Windows 7 will forever be stuck with an easily(?) exploitable font engine vulnerability?
- lexicality 7y agoThat's what end of life generally means. Look at what happened to XP...
- vbezhenar 7y agoThey fixed dangerous exploit in XP after EOL. I think that they'll fix this exploit as well, unless it's not very dangerous.
- EmilioMartinez 7y agoWhat is a good way to keep up with active vulnerabilities and zero-days?
- alyandon 7y agoRequires a Microsoft account but I subscribe to their email lists. https://www.microsoft.com/en-us/msrc/technical-security-notifications https://www.microsoft.com/en-us/msrc/technical-security-noti...