Microsoft releases emergency patch for critical Windows flaw

Microsoft has released an emergency patch for all Windows-based systems in order to address a recently-discovered critical flaw in the operating system.

In a TechNet advisory published July 20, Microsoft has said that the patch resolves a vulnerability in the Microsoft Font Driver that, if exploited, "allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded OpenType fonts."

The vulnerability is based on the way Windows' Adobe Type Manager Library handles the OpenType format.

"An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights," the advisory added.

Simply put, a critical vulnerability in the way Windows handles font rendering can, if exploited, let a hacker take over a Windows-based system. Users running Windows Vista, Windows 7, 8, 8.1 and Windows RT are all affected with the bug, including those running Windows Server 2008 and later.

However, neither Server 2003 nor Windows XP are not included and will not be part of the patch. Attackers can exploit the weakness by luring targets into compromised sites or opening malicious files.

While there is no indication that the flaw is being aggressively exploited, Microsoft believes knowledge of the flaw is public, as the update comes a day ahead of the weekly scheduled Patch Tuesday release from the company, or every second Tuesday of the month.  

Trend Micro Labs reports that the flaw was among those discovered after Italian spyware-maker Hacking Team was hacked in early July, when internal memos and other information were leaked online.

Mateusz Jurczyk, of Google Project Zero, and Genwei Jiang, of FireEye Inc., found the vulnerability after combing through the leaked trove of documents.

Microsoft has already addressed two other vulnerabilities discovered during the hack last week, one being a remote-code execution bug in Internet Explorer 11 on Windows 7 and 8.1,  as well as for another remote execution code for the RDP server for Windows 7 and 8.