Type 1字體解析遠程代碼執行漏洞通告是怎么樣的

Type 1字體解析遠程代碼執行漏洞通告是怎么樣的，很多新手對此不是很清楚，為了幫助大家解決這個難題，下面小編將為大家詳細講解，有這方面需求的人可以來學習下，希望你能有所收獲。

0x00 漏洞背景

近日，360-CERT監測到微軟公司發布了一份編號ADV200006 的緊急漏洞通告，通告表示有在野攻擊行動使用了位于Adobe Type Manager Library中的兩個遠程代碼執行0Day漏洞，鑒于漏洞嚴重，發布該通告指導用戶在補丁發布前規避風險。

據悉，這兩個遠程代碼執行漏洞的原因主要是Windows Adobe Type Manager Library并沒有正確處理特殊構造的多重母版字體——Adobe Type1 PostScript格式，漏洞評估嚴重，已停止服務的WIN7也受到漏洞影響。

攻擊者可通過多種場景實施攻擊，比如說服受害者在Windows的預覽中訪問一個特殊構造的文檔。

目前微軟正在準備漏洞相關的補丁，預計下個月的補丁日會發布，暫時只提供緩解方式。

360-CERT建議用戶關注微軟對于該漏洞的修復進展，緊急用戶可先參考對應的緩解方案。

0x01 受影響版本

Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1803 (Server Core Installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)

0x02 緩解建議

微軟在通告中提供了多種選擇，用戶可以自行選擇（具體見參考鏈接），此處主要建議重命名ATMFD.DLL文件的方式（同時建議用戶安裝360安全衛士進行主動防御）。

32位操作系統緩解方式：

1. 在管理員權限的命令行里輸入

cd "%windir%\system32"
takeown.exe /f atmfd.dll
icacls.exe atmfd.dll /save atmfd.dll.acl
icacls.exe atmfd.dll /grant Administrators:(F)
rename atmfd.dll x-atmfd.dll

1. 重啟系統

64位操作系統緩解方式：

1. 在管理員權限的命令行里輸入

    cd "%windir%\system32"
    takeown.exe /f atmfd.dll
    icacls.exe atmfd.dll /save atmfd.dll.acl
    icacls.exe atmfd.dll /grant Administrators:(F)
    rename atmfd.dll x-atmfd.dll
    cd "%windir%\syswow64"
    takeown.exe /f atmfd.dll
    icacls.exe atmfd.dll /save atmfd.dll.acl
    icacls.exe atmfd.dll /grant Administrators:(F)
    rename atmfd.dll x-atmfd.dll

重啟系統

看完上述內容是否對您有幫助呢？如果還想對相關知識有進一步的了解或閱讀更多相關文章，請關注億速云行業資訊頻道，感謝您對億速云的支持。