Threat Update: Microsoft Warns Of Windows Adobe Type Manager Library Out-of-Band RCE

Threat Update: Microsoft Warns Of Windows Adobe Type Manager Library Out-of-Band Remote Code Execution Vulnerabilities: ADV200006

On 23 March 2020, Microsoft released an out-of-band security advisory ADV200006 to address two critical remote code execution vulnerabilities in Adobe Type Manager (ATM) Library. The name of the ATM library came from an Adobe developed tool, ATM Light. Microsoft included native support for the ATM fonts. These vulnerabilities exist within Windows’ native integration for support of PostScript fonts. Microsoft is aware of limited, targeted attacks exploiting these vulnerabilities in the wild.

Recommendations

Enhanced Security Configuration, which is turned on by default on Windows Servers, does not mitigate the vulnerabilities. While patches are not available for these vulnerabilities, Microsoft provided the following workarounds to secure vulnerable systems:

Disable the Preview Pane and Details Pane in Windows Explorer (WE)
Disable the WebClient service
Rename ATMFD.DLL or disable the registry key for Windows 8.1 and below

Disabling the Preview Pane and Details Pane in Windows Explorer(WE) Disabling the Preview and Details panes in WE prevents the automatic display of OTF fonts in WE. While this prevents malicious files from being viewed in WE, it does not prevent a local, authenticated user from running a specially crafted program to exploit this vulnerability. To disable these panes in Windows 8.1 and before, perform the following steps:

Open WE, click Organize, and then click Layout.

Clear both the Details pane and Preview pane menu options.
Click Organize, and then click Folder and search options.
Click the View tab.
Under Advanced settings, check the Always show icons, never thumbnails box.
Close all open instances of WE for the change to take effect.
Disable the WebClient service.

Disabling the WebClient service helps protect affected systems from attempts to exploit this vulnerability by blocking the most likely remote attack vector through the WebDAV client service. It is still possible for remote attackers who successfully exploit this vulnerability to cause the system to run programs located on the targeted user’s computer or the LAN, but users will be prompted for confirmation.

To disable the WebClient Service, perform the following steps:

Click Start, click Run, type Services.msc, and click OK.
Right-click WebClient service and select Properties.
Change the Startup type to Disabled. If the service is running, click Stop.
Click OK and exit the management application.

Rename ATMFD.DLL:

Enter the following commands at an administrative command prompt:
cd “%windir%\system32”
takeown.exe /f atmfd.dll
icacls.exe atmfd.dll /save atmfd.dll.acl
icacls.exe atmfd.dll /grant Administrators:(F)
rename atmfd.dll x-atmfd.dll
Restart the system.

Optional procedure for Windows 8.1 operating systems and below (disable ATMFD):

Method 1 (manual):
- Run regedit.exe as Administrator.
- In Reg Editor, navigate to the following sub key (or create it) and set its DWORD value to 1: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 1
- Close Registry Editor and restart the system.
Method 2 (using a script):
- Create a text file named ATMFD-disable.reg that contains the following text:
- Windows Registry Editor Version 5.00
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
- “DisableATMFD”=dword:00000001
- Run regedit.exe.
- In the Registry Editor, click the File menu and then click Import.
- Navigate to and select the ATMFD-disable.reg file that you created in the first step.
- Click Open and then click OK to close Registry Editor.

Customers are advised to apply ADV200006 workarounds for affected operating systems until a patch is released to be protected from this vulnerability.

Details

Adobe Type Manager, provided by atmfd.dll, is a kernel module by Windows to support OpenType fonts. The vulnerabilities exist within the way that Windows parses OpenType fonts. Successful exploitation would require a remote attacker to convince a user to open a specially crafted document leading to memory corruption and executing arbitrary code on the system. This may result in a complete compromise of vulnerable systems.

Affected Systems:

Windows 10
Windows 8.1
Windows 7
Windows RT 8.1
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows 2016
Windows Server 2019
Windows Server, version 1803
Windows Server, version 1903
Windows Server, version 1909

Proof of concept: There are no known public proofs of concepts available for these vulnerabilities at this time, but Microsoft is aware of “limited targeted attacks” exploiting these vulnerabilities in the wild.

ZeroFOX Alpha Team is actively monitoring this situation as new details develop. ZeroFOX recommends enacting the recommendations above as a precaution until further information is made available.