Special Microsoft Bulletin Patching Remote Code Execution Flaw in OpenType Font Drivers

Published: 2015-07-20. Last Updated: 2015-07-20 17:17:27 UTC
by Johannes Ullrich (Version: 1)
11 comment(s)

Microsoft just released a special "out fo band" security bulletin with a patch for a remote code execution vulnerability in Windows' OpenType font drivers. The update replaces a patch released last week (MS15-077). Microsoft rates the vulnerability critical for all currently supported versions of Windows. Microsoft says in it's bulletin, that it had information that the vulnerability was public, but had no indication that it was actively exploited. MS15-077 had been exploited at the time the MS15-077 bulletin was released last week. As a workaround, users may remove the font driver, but this may cause applications that rely on it to not be able to display certain fonts.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS15-078 Remote Code Execution Vulnerability in Microsoft Font Driver (Replaces MS15-077 )
Adobe Type Manager Library atmfd.dll
CVE-2015-2426		 KB 3079904 Exploits Detected against related vulnerability CVE-2015-2387 (see MS015-077). Vulnerability may have been public. Severity:Critcal
Exploitability: 0		 Critical
or
PATCH NOW		 Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Important patches for servers that do not use outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threats.

       

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

Keywords:
11 comment(s)
ISC StormCast for Monday, July 20th 2015 http://isc.sans.edu/podcastdetail.html?id=4575

Comments

Login here to join the discussion.


Diary Archives