Microsoft is warning users of its Windows product of as zero day exploit that can attack even fully updated computers. A zero day exploit is a vulnerability that is known to a software maker with no patch or fix available. Basically its a nasty surprise.
According to Microsoft a remote code-execution vulnerability is being used in “limited targeted attacks.” Microsoft published the advisory on Monday morning.
The security flaw exists in the Adobe Type Manager Library, a Windows DLL file that a wide variety of apps use to manage and render fonts available from Adobe Systems. Hackers exploit the vulnerability by convincing a target to open a booby-trapped document or viewing it in the Windows preview pane.
According to the advisory “Microsoft is aware of limited, targeted attacks that attempt to leverage this vulnerability.” Microsoft made no mention if the exploits are successfully executing malicious payloads or simply attempting it. Windows security defenses normally prevents exploits from working as hackers intended. The advisory made no reference to the volume or geographic locations of exploits. There is no fix available and no indication when one would ship.
The best advice available for non-tech Windows users is to refrain from opening attachments from people you don’t know. For tech savvy users Microsoft suggests the following;
- Disabling the Preview Pane and Details Pane in Windows Explorer
- Disabling the WebClient service
- Rename ATMFD.DLL, or alternatively, disable the file from the registry
