News

Microsoft Issues Security Advisory on Windows Aero

Microsoft released a security advisory on Tuesday concerning a Windows component involved with desktop graphics display.

At issue is what Redmond calls a "publicly disclosed" remote code execution exploit in the Canonical Display Driver (cdd.dll), a Windows component used for desktop composition. It only affects systems that have enabled the Windows Aero graphics theme. The advisory (2028859) pertains to Windows 7 64-bit, Windows Server 2008 R2 for 64-bit systems and Windows Server 2008 R2 Itanium operating systems.

The cdd.dll driver is used to blend graphic device interfaces and DirectX drawing, according to Microsoft's advisory. The exploit could be triggered when or if the Canonical Display Driver does not properly parse data copied from user mode to kernel mode within Windows 7.

The attack scenario associated with this cdd.dll vulnerability is still largely theoretical, according to Microsoft's advisory.

"Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)," the advisory notes.

Microsoft said it is working on a patch but wasn't aware of any in-the-wild exploits. More to the point, Redmond said it will "release the security update once it has reached an appropriate level of quality for broad distribution."

Unlike past security advisories, Microsoft did not say there might be an out-of-band patch. Security experts don't expect one because of the highly technical nature of this exploit.

"If I were to take a guess, I'd say that it's unlikely that we'll see effective exploit code that will target a large user base, and that's if we see exploit code at all," said Tyler Reguly, lead security research engineer at nCircle. "For these reasons, I don't expect this issue to be patched out-of-band by Microsoft. It will probably be rolled into their regular patch cycle and released at some point in the future."

In the meantime, customers can help protect themselves against potential threats against the Windows Canonical Display Driver by disabling Windows Aero, the graphics display theme introduced with Windows Vista. Microsoft says that with Windows Aero disabled, the path by which cdd.dll can be exploited is bypassed.

"It's almost funny when you think about this from a mitigation perspective," added Reguly. "Older, less powerful systems won't run Aero. So, in a way, having an outdated computer mitigates this vulnerability."

There is no notification on when to expect a patch for this vulnerability. Microsoft also issued a security advisory (983438) in late April for a SharePoint vulnerability, but it is yet to be patched.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.

  • World Map Image

    Microsoft Taps Nebius in $17B AI Infrastructure Deal To Alleviate Cloud Strain

    Microsoft has signed a five-year, $17.4 billion agreement with Amsterdam-based Nebius Group to expand its AI computing capabilities through third-party GPU infrastructure.

  • Microsoft Brings Copilot AI Into Viva Engage

    Microsoft 365 Copilot in Viva Engage is now generally available, extending Copilot's AI-powered assistant capabilities deeper into the Viva platform.