Microsoft has alerted Windows users that hackers are exploiting a previously undisclosed zero-day vulnerability in all versions of the software.
Rated as critical, the vulnerabilities concern two unpatched remote code execution (RCE) vulnerabilities related to how Windows manages and renders fonts. These flaws can be exploited after a user is tricked into opening or previewing a document containing the malware, allowing hackers to remotely install malware on the device.
While Microsoft has suggested that the current attacks are limited and targeting certain devices, the company did not reveal the scale of these attacks.
Zero-day vulnerability
Microsoft is currently working on a patch to fix these vulnerabilities, which it says can impact all Windows versions – including Windows Server operating systems and Windows 7, which recently finished receiving support from the company.
This update is expected to arrive as part of the company’s regular Patch Tuesday release, however when it comes to Windows 7, only enterprise users with extended warranty will receive the patch.
Microsoft said, “Updates that address security vulnerabilities in Microsoft software program are usually launched on Update Tuesday, the second one Tuesday of every month. This anticipated schedule allows for partner quality warranty and IT planning, which helps preserve the Windows surroundings as a reliable, secure preference for our customers.”
In the interim, the company has released a guide to workaround and mitigate the risk. These workarounds include disabling the preview pane in Windows. This will ensure that Windows Explorer or File Explorer (Windows 10) will not display OpenType fonts automatically.
Other workarounds include disabling the WebClient provider and renaming ATMFD.DLL (the file name of Adobe Type Manager Font Driver).
Via: ZDNet
