Mitigating Windows Type 1 Font Parsing RCE Vulnerability

A new critical vulnerability in Microsoft Adobe Type Manager Library was discovered after investigating several Windows 7 based attacks. Microsoft is aware of this issue but hasn't published any update to solve it yet.

There are two remote code execution vulnerabilities in Microsoft Windows when the Windows Adobe Type Manager Library mishandles a special multi-master font- Adobe Type 1 PosrScript format. This vulnerability can be exploited in multiple ways, such as convincing a user to open a specially crafted document or viewing it in the Windows Preview pane, which makes the Windows Preview pane one of the possible attack vectors.

CIS 5th Control : Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

Although Microsoft is aware of this vulnerability and of the attacks that leveraged it, they are still working on a fix that will hopefully be released on update Tuesday which is the second Tuesday of each month.

These are the affected Microsoft Windows servers versions by this critical remote code execution vulnerability:

* Windows Server 2008 for 32-bit Systems Service Pack 2

* Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

* Windows Server 2008 for Itanium-Based Systems Service Pack 2

* Windows Server 2008 for x64-based Systems Service Pack 2

* Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

* Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1

* Windows Server 2008 R2 for x64-based Systems Service Pack 1

* Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

* Windows Server 2012

* Windows Server 2012 (Server Core installation)

* Windows Server 2012 R2

* Windows Server 2012 R2 (Server Core installation)

* Windows Server 2016

* Windows Server 2016 (Server Core installation)

* Windows Server 2019

* Windows Server 2019 (Server Core installation)

how can you mitigate it:

This issue can be solved by hardening your servers properly. Securing your servers’ configurations can protect your organization without waiting for the fix to be published. Here are CalCom’s team of expert recommendations:

1. Disable the Preview Pane and Details Pane in Windows Explorer
2. Disable the WebClient service
3. Rename ATMFD.DLL
4. For Windows 2016 and below – Optional disable ATMFD

But easier said than done. Server hardening can be a painful procedure. If you're reading this article, you probably already know it. Any simple hardening action can result in production breakdown despite the effort to prevent it.

CHS by CalCom automates the entire server hardening process. CHS's unique ability to 'learn' your network abolishes the need to perform lab testing while ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production hassle-free.