{"id":13909,"date":"2020-04-01T00:14:22","date_gmt":"2020-03-31T22:14:22","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=13909"},"modified":"2024-10-05T21:04:29","modified_gmt":"2024-10-05T19:04:29","slug":"mitigating-windows-0-day-adv200006-via-gpo","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/04\/01\/mitigating-windows-0-day-adv200006-via-gpo\/","title":{"rendered":"Mitigating Windows 0-day ADV200006 via GPO"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"http:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2013\/03\/winb.jpg\" width=\"58\" height=\"58\">[<a href=\"https:\/\/www.borncity.com\/blog\/?p=230153\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]Small hint for administrators of large Windows environments in the Active Directory environment who need to plug the ADV200006 0-day vulnerability. Mitigation is possible using Group Policy. <\/p>\n<p><!--more--><\/p>\n<h2>The Windows 0-day vulnerability ADV200006<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/vg05.met.vgwort.de\/na\/8a174ddbadbd46b3b9c93582b342a31c\" width=\"1\" height=\"1\">In all supported Windows versions, there are two unpatched vulnerabilities in the Adobe Type 1 Manager Library. Both vulnerabilities allow remote code execution because the Windows Adobe Type Manager Library does not correctly handle a specially crafted multi-master font, the Adobe Type 1 PostScript format. An attacker could exploit this vulnerability, for example, by tricking a user into opening a specially crafted document or viewing it in the Windows preview window.<\/p>\n<p>The information is found in <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/ADV200006\" target=\"_blank\" rel=\"noopener noreferrer\">ADV200006<\/a>, all Windows versions are affected, from Windows 7 SP1 to Windows 8.1 and Windows 10 &#8211; and of course all server counterparts. On systems running Windows 10, a successful attack can only occur in an AppContainer sandbox context, and thus only allows limited permissions and code execution capabilities. Hackers are now trying to exploit this vulnerability. Microsoft is aware of this vulnerability and is working on a fix, but has not yet released a patch. I expect to have it on the regular patchday, April 14, 2020. <\/p>\n<h2>Mitigate vulnerabilities via GPO<\/h2>\n<p>Microsoft provides workarounds for older operating systems such as Windows 7 SP1 and Windows 8.1 and their server counterparts to prevent the vulnerability from being exploited. Microsoft has published these workarounds in <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/ADV200006\" target=\"_blank\" rel=\"noopener noreferrer\">ADV200006<\/a>. However, these approaches are not viable in larger corporate environments<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">FYI, i created a blog post which describes how to mitigate this in a large AD environment using GPOs &#8211; here is post link: <a href=\"https:\/\/t.co\/BtVt3ejZvw\">https:\/\/t.co\/BtVt3ejZvw<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ActiveDirectory?src=hash&amp;ref_src=twsrc%5Etfw\">#ActiveDirectory<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/GPO?src=hash&amp;ref_src=twsrc%5Etfw\">#GPO<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ADV200006?src=hash&amp;ref_src=twsrc%5Etfw\">#ADV200006<\/a> <a href=\"https:\/\/t.co\/kUUVIlEW4m\">pic.twitter.com\/kUUVIlEW4m<\/a><\/p>\n<p>\u2014 Sylvain Cortes (@sylvaincortes) <a href=\"https:\/\/twitter.com\/sylvaincortes\/status\/1244237223370862592?ref_src=twsrc%5Etfw\">March 29, 2020<\/a><\/p><\/blockquote>\n<p><span id=\"preservef1f7433a279142fe8b01165094e6386c\" class=\"wlWriterPreserve\"><SCRIPT charset=\"utf-8\" src=\"https:\/\/platform.twitter.com\/widgets.js\" async><\/SCRIPT><\/span> <\/p>\n<p>Microsoft MVP Sylvain Cortes has written a blog post on how to use Group Policy to make it more difficult or impossible to exploit the vulnerabilities in question. This includes turning off the preview in Windows Explorer and disabling the WebClient &#8211; both measures also suggested by Microsoft in <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/ADV200006\" target=\"_blank\" rel=\"noopener noreferrer\">ADV200006<\/a>. Details can be found in the corresponding blog post. <\/p>\n<p><strong>Similar articles:<\/strong><br \/><a href=\"https:\/\/borncity.com\/win\/2020\/03\/24\/0-day-vulnerability-in-windows-adobe-type-library\/\">0-day vulnerability in Windows Adobe Type Library<\/a><br \/><a href=\"https:\/\/borncity.com\/win\/2020\/03\/25\/microsoft-has-revised-adv200006-type-1-font-parsing-rce\/\">Microsoft has revised ADV200006 (Type 1 Font Parsing RCE)<\/a><br \/><a href=\"https:\/\/borncity.com\/win\/2020\/03\/27\/0patch-fixes-0-day-adobe-type-library-bug-in-windows-7\/\">0patch fixes 0-day Adobe Type Library bug in Windows 7<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Small hint for administrators of large Windows environments in the Active Directory environment who need to plug the ADV200006 0-day vulnerability. Mitigation is possible using Group Policy.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,2],"tags":[69,194],"class_list":["post-13909","post","type-post","status-publish","format-standard","hentry","category-security","category-windows","tag-security","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=13909"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13909\/revisions"}],"predecessor-version":[{"id":35788,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/13909\/revisions\/35788"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=13909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=13909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=13909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}