報告編號：B6-2020-032401
更新日期：2020-03-23
0x01 漏洞背景
近日，360-CERT監測到微軟公司發佈了一份編號ADV200006 的緊急漏洞通告，通告表示有在野攻擊行動使用了位於Adobe Type Manager Library中的兩個遠程代碼執行0Day漏洞，由於漏洞嚴重發布該通告指導用戶在補丁發佈前規避風險。
據悉，這兩個遠程代碼執行漏洞的原因主要是Windows Adobe Type Manager Library並沒有正確處理特殊構造的多重母版字體——Adobe Type1 PostScript格式，漏洞評估嚴重，已停止服務的WIN7也受到漏洞影響。
攻擊者可通過多種場景實施攻擊，比如說服受害者在Windows的預覽中訪問一個特殊構造的文檔。
目前微軟正在準備漏洞相關的補丁，預計下個月的補丁日會發布，暫時只提供緩解方式。
360-CERT建議用戶關注微軟對於該漏洞的修復進展，緊急用戶可先參考對應的緩解方案。
0x02 受影響版本
Windows 10 for 32-bit SystemsWindows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systemsWindows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server, version 1803 (Server Core Installation)
Windows Server, version 1903 (Server Core installation)
Windows Server, version 1909 (Server Core installation)
0x03 緩解建議
微軟在通告中提供了多種選擇，用戶可以自行選擇（具體見參考鏈接），此處主要建議重命名ATMFD.DLL文件的方式（同時建議用戶安裝360安全衛士進行主動防禦）。
32位操作系統緩解方式：
- 在管理員權限的命令行裡輸入
<code>cd "%windir%\\system32"
takeown.exe /f atmfd.dll
icacls.exe atmfd.dll /save atmfd.dll.acl
icacls.exe atmfd.dll /grant Administrators:(F)
rename atmfd.dll x-atmfd.dll
/<code>
- 重啟系統
64位操作系統緩解方式：
- 在管理員權限的命令行裡輸入
<code> cd "%windir%\\system32"
takeown.exe /f atmfd.dll
icacls.exe atmfd.dll /save atmfd.dll.acl
icacls.exe atmfd.dll /grant Administrators:(F)
rename atmfd.dll x-atmfd.dll
cd "%windir%\\syswow64"
takeown.exe /f atmfd.dll
icacls.exe atmfd.dll /save atmfd.dll.acl
icacls.exe atmfd.dll /grant Administrators:(F)
rename atmfd.dll x-atmfd.dll
/<code>
- 重啟系統
0x04 時間線
2020-03-24 微軟發佈緊急漏洞通告
2020-03-24 360-CERT發佈漏洞通告
0x05 參考鏈接
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200006
閱讀更多 360CERT 的文章
