{"vuid":"VU#354840","idnumber":"354840","name":"Microsoft Windows Type 1 font parsing remote code execution vulnerabilities","keywords":[""],"overview":"Microsoft Windows contains two vulnerabilities in the parsing of Adobe Type 1 fonts, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.","clean_desc":"Adobe Type Manager,which is provided by atmfd.dll,is a kernel module that is provided by Windows and provides support for OpenType fonts. Two vulnerabilities in the Microsoft Windows Adobe Type Manager library may allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system. This vulnerability affects all supported versions of Windows,as well as Windows 7. This vulnerability is being exploited in the wild.","impact":"By causing a Windows system to open a specially crafted document or view it in the Windows preview pane, an unauthenticated remote attacker may be able to execute arbitrary code with kernel privileges on a vulnerable system. Windows 10 based operating systems would execute the code with limited privileges, in an AppContainer sandbox.","resolution":"Apply an update This issue has been addressed in Microsoft updates for CVE-2020-1020. Please also consider the following workarounds that are listed in Microsoft Security Advisory ADV200006:","workarounds":"Rename ATMFD.DLL This mitigation appears to be to the most effective workaround for this vulnerability, as it blocks the vulnerable code from being used by Windows. Please see Microsoft Security Advisory ADV200006 for more details. Because supported Windows 10 versions do not use ATMFD.DLL, this mitigation is not applicable on those platforms. Disable the preview pane and details pane in Windows Explorer Please see Microsoft Security Advisory ADV200006 for more details. Disable the WebClient service Please see Microsoft Security Advisory ADV200006 for more details.","sysaffected":"","thanks":"","author":"This document was written by Will Dormann.","public":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006","https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation"],"cveids":["CVE-2020-1020"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2020-03-23T19:50:36Z","publicdate":"2020-03-23T00:00:00Z","datefirstpublished":"2020-03-23T20:42:09Z","dateupdated":"2020-04-14T18:00:47Z","revision":26,"vrda_d1_directreport":"0","vrda_d1_population":"4","vrda_d1_impact":"4","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"W","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"H","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"10","cvss_basevector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","cvss_temporalscore":"9","cvss_environmentalscore":"9.0200314848","cvss_environmentalvector":"CDP:ND/TD:H/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}