Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Microsoft patches Windows zero-day found in Hacking Team's leaked docs

Gregg Keizer | July 21, 2015
Quashes bug in all editions of Windows, including not-yet-final Windows 10.


Microsoft today issued one of its sporadic emergency, or "out-of-band," security updates to patch a vulnerability in Windows -- including the yet-to-be-released Windows 10 -- that was uncovered by researchers sifting through the massive cache of emails leaked after a breach of Italian surveillance vendor Hacking Team.

The Milan-based vendor sells surveillance software to governments and corporations, and markets zero-day vulnerabilities that its clients can use to silently infect targets with the firm's software. Researchers have found several zero-days -- flaws that were not fixed before they went public -- in the gigabytes of pilfered documents and messages, including three in Adobe's Flash Player, since July 5.

The Microsoft vulnerability adds to the growing tally.

The Redmond, Wash. company's update, labeled MS15-078, fixed a flaw in the Windows Adobe Type Manager Library, which handles the rendering of OpenType fonts, a format co-created by Microsoft and Adobe.

Microsoft credited FireEye's Genwei Jiang and Google Project Zero's Mateusz Jurczyk with reporting the vulnerability.

"CVE-2015-2426 is a straight-to-kernel remote code execution vulnerability," a FireEye spokesman said in an email reply to questions, using the flaw's Common Vulnerabilities and Exposure identifier. "The vulnerability was leaked with the Hacking Team email breach."

FireEye added that the bug was in the way the Adobe Type Manager Library font driver -- the file "ATMFD.dll" -- parses OpenType fonts.

Microsoft classified the vulnerability as "critical," its most serious threat level, because a successful attack could hijack a vulnerable Windows device. "An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights," Microsoft's write-up said.

Cyber criminals could exploit the bug by duping victims into opening a document that included malformed OpenType fonts, or by luring them to malicious websites with embedded OpenType.

While the vulnerability had gone public before today, Microsoft asserted that it knew of no actual in-progress attacks. "[But] our analysis has shown that exploit code could be created in such a way that an attacker could consistently exploit this vulnerability," the company added.

"Looks as if it is 'easy' to exploit reliably, [so] that's why they are going out-of-band," said Wolfgang Kandek, CTO of security vendor Qualys, in an interview over instant message.

Microsoft may have also pulled the trigger because of Windows 10's looming launch: The operating system is to reach beta testers Thursday, July 29, then begin rolling out to customers who have "reserved" a copy of the free upgrade from Windows 7 or Windows 8.1. Sans a patch -- and with the vulnerability out -- Microsoft would have been mocked for claiming Windows 10 was more secure than previous versions of Windows.


1  2  Next Page 

Sign up for CIO Asia eNewsletters.