Hello, welcome to the Tuesday, March 24th, 2020 edition of the Sandcentred Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Well, with everything going on in the world, probably the last thing you need is a vulnerability in Microsoft Windows that's currently not patched and that is already

being exploited. That's exactly what Microsoft announced today. Now, the vulnerability is

a font parsing vulnerabilities. These font parsing vulnerabilities are quite common. There are probably

a couple being fixed each month at Patch Tuesday. This one in particular relates to the type

one font parsing and affects the Adobe Type Manager library or ATMfd.d. DDL. All current versions of Windows are affected back to Windows

732 and 64 bits. Also, Windows Server 2008 and later is affected. So what can you do to mitigate this until a patch arrives?

Well, Microsoft offers a couple of workarounds.

The first one is just a disable, the preview pane and details pane in Windows Explorer.

That's probably the easiest thing to do as a regular user because it just requires you to use some basic settings.

And now a bit more tricky is either disabling the web client service, which actually probably doesn't ultimately fix the problem, but reduces your attack surface somewhat.

And probably the best fix, but a little bit the trickiest one is to rename ATMFD.D. DLL, the vulnerable

DLL. Now, a little bit about this. So renaming DLs like this, I wouldn't normally recommend it.

It tends to have some unintended consequences because now essentially you can no longer

render any fonts that need to be rendered by this library.

However, DDA found that on recent Windows 10 systems, talking anything 18 or 04 and later, this DLL

often appears to be missing.

So maybe it's not really all that important.

I'll leave this up to you.

It's really too early to make it of a definite decision whether or not it's worthwhile deleting or renaming this DL.

At this point, there is no public exploit for this vulnerability. It has been seen in targeted attacks.

Now, historically, these font parsing vulnerabilities, in particular as far as

...