Microsoft ha informado de que existen dos vulnerabilidades de ejecución de código remoto en Windows cuando la biblioteca de Adobe Type Manager de Windows maneja incorrectamente una fuente especialmente diseñada en formato Adobe Type 1 PostScript. Hay varias formas en que un atacante podría aprovechar la vulnerabilidad, como convencer a un usuario para que abra un documento especialmente diseñado o verlo en el panel Vista previa de Windows.
Microsoft es consciente de esta vulnerabilidad y está trabajando en una solución. Las versiones del sistema operativo que se ven afectadas por esta vulnerabilidad son Windows 8.1, Windows 10 and Windows Server 2008/2012/2016/2019.
These are two code execution issues in the Adobe Type Manager Library, which does not handle Adobe Type fonts well 1 and this allows an attacker to execute code with kernel privileges if the victim opens a file or in the Windows font preview. The flaw was discovered while it was being exploited in some attacks.
So far, three ways to mitigate the problem have been described, but they depend heavily on the system: disable the Windows preview pane from File Explorer, disable the WebClient Service and rename ATMFD.DLL (rename atmfd.dll x-atmfd.dll).
In Windows from 1709, this DLL is not present, but that does not mean it is not vulnerable. The good news is that precisely the Windows starting from 1709 process fonts using a driver called fontdrvhost.exe which is located inside an AppContainer. This makes the attacker's freedom of movement very limited. It is not known if the attacks found also allow escaping the sandbox, although it seems unlikely. Even so, they have rated the vulnerability as critical.