News for hackers. Stuff that matters.

A comment on Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution.

Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by acqq on Monday July 20, 2015 @02:56PM (#9918186)
Looking at the properties of the vulnerable dll, it's "Copyright 1983-1990, 1993-2004 Adobe Systems Inc."

In hindsight it's to be expected that the code doesn't do enough "safe" checks which were developed only after the famous Gates memo of 2002 (reposted by Microsoft on the 10 years anniversary of it: https://news.microsoft.com/2012/01/11/memo-from-bill-gates/ ) and probably even more so as the code is copyrighted by Adobe and not Microsoft. And even more so as "Microsoft Windows does not release any OpenType fonts natively (but has the DLL because) third-party applications could install them."

(By the way, I highly admire the traditional Windows for caring about backward compatibility. I hope this doesn't change even if it's obviously harder.)

[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by johncolanduoni on Monday July 20, 2015 @04:46PM (#9918946)
> Microsoft Windows does not release any OpenType fonts natively (but has the DLL because) third-party applications could install them.

I'm not sure about Windows itself, but I know for a fact that Office includes at least one OpenType font: Cambria Math. It relies on the OpenType math typesetting information (which was largely designed by Microsoft). In addition, TrueType's layout information in not sophisticated enough for many languages (e.g. Arabic), so these users are most certainly using OpenType fonts.

[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by jahewson on Monday July 20, 2015 @08:08PM (#9919917)
I imagine that Microsoft have their own code for handling the OpenType layout tables, given that they co-developed them. OpenType fonts come in two flavours, PostScript and TrueType, depending on which format the glyph outlines use. Microsoft only ships fonts with TrueType outlines. The PostScript outlines are in CFF format, which is an Adobe technology. I expect that the Adobe code is responsible for dealing with them, especially as there is no published standard describing how to rasterize PostScript fonts with pixel accuracy.
[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by wfunction on Monday July 20, 2015 @07:04PM (#9919680)
Do you know of any references where I could read more about font formats, like the differences between OT vs. TT, the features of each, etc.?

I know close to nothing about them.

[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by jahewson on Monday July 20, 2015 @08:17PM (#9919951)
The OT spec is the definitive document: https://www.microsoft.com/typography/otspec/otff.htm Look at the list of font tables, OpenType supports everything, but the individual formats are (to oversimplify), as follows:

- TTF = Required Tables + Tables Related to TrueType Outlines

- PostScript Flavor OTF = Required Tables + Tables Related to PostScript Outlines + Advanced Typographic Tables

- TrueType Flavor OTF = Required Tables + Tables Related to TrueType Outlines + Advanced Typographic Tables

Note that in a PostScript flavor OTF the glyph outlines are simply an entire Adobe CFF font embedded in a table. CFF is in turn a compact representation of a PostScript Type 1 font. There's an entire CFF spec too: https://partners.adobe.com/public/developer/en/font/5176.CFF...

[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by wfunction on Tuesday July 21, 2015 @12:28AM (#9920565)
Thanks!
[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by grub5000 on Monday July 20, 2015 @03:08PM (#9918278)
With the other 8+ 10/10 CVEs adobe announced today, they're not exactly covering themselves in glory here...
[ Parent | on HN ]
Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by Someone1234 on Monday July 20, 2015 @03:14PM (#9918317)
You mean on July 14th. They published no others today, today is highly unusual since typically Microsoft only patches one Tuesday per month (and their patch day was last Tuesday).

Releasing a patch on a Monday means it is likely highly critical and weaponizable (which was the impression I got reading the release).

[ Parent | on HN ]