| Vector: | Remote |
| Severity: | High |
| Patch: | Patched |
| Impact: | Remote Code Execution (RCE) |
| Software: |
Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows RT 8.1 Microsoft Windows RT Microsoft Windows Server 2012 |
A remote attacker can execute arbitrary code on the target system.
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability resides within the Windows Adobe Type Manager Library (atmfd.dll) when handling specially crafted OpenType fonts. A remote attacker can create a specially crafted OpenType font file and deliver it to the victim using various vectors.
An attacker could use web-based scenario. The malisons font can be delivered via a website. In this case, the exploitation will be triggered, when the victim visits a web page, which loads malicious OpenType font.
Microsoft is not aware of any attacks using this vulnerability, however the exploit code was extracted after Hacking Team data leak. It is highly possible, that a working exploit was used in attacks powered by Hacking Team software.
Workarounds
Microsoft suggests disabling access to vulnerable library in case, when immediate patch installation is not possible. All provided solutions however, require system restart. Please, refer to Microsoft advisory for any workarounds.
CVE ID: CVE-2015-2426
Links: https://technet.microsoft.com/en-us/library/security/MS15-078
Solution: Install security patch KB 3079904 ASAP.
