News

Microsoft Issues Security Advisory on Windows Aero

Microsoft released a security advisory on Tuesday concerning a Windows component involved with desktop graphics display.

At issue is what Redmond calls a "publicly disclosed" remote code execution exploit in the Canonical Display Driver (cdd.dll), a Windows component used for desktop composition. It only affects systems that have enabled the Windows Aero graphics theme. The advisory (2028859) pertains to Windows 7 64-bit, Windows Server 2008 R2 for 64-bit systems and Windows Server 2008 R2 Itanium operating systems.

The cdd.dll driver is used to blend graphic device interfaces and DirectX drawing, according to Microsoft's advisory. The exploit could be triggered when or if the Canonical Display Driver does not properly parse data copied from user mode to kernel mode within Windows 7.

The attack scenario associated with this cdd.dll vulnerability is still largely theoretical, according to Microsoft's advisory.

"Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)," the advisory notes.

Microsoft said it is working on a patch but wasn't aware of any in-the-wild exploits. More to the point, Redmond said it will "release the security update once it has reached an appropriate level of quality for broad distribution."

Unlike past security advisories, Microsoft did not say there might be an out-of-band patch. Security experts don't expect one because of the highly technical nature of this exploit.

"If I were to take a guess, I'd say that it's unlikely that we'll see effective exploit code that will target a large user base, and that's if we see exploit code at all," said Tyler Reguly, lead security research engineer at nCircle. "For these reasons, I don't expect this issue to be patched out-of-band by Microsoft. It will probably be rolled into their regular patch cycle and released at some point in the future."

In the meantime, customers can help protect themselves against potential threats against the Windows Canonical Display Driver by disabling Windows Aero, the graphics display theme introduced with Windows Vista. Microsoft says that with Windows Aero disabled, the path by which cdd.dll can be exploited is bypassed.

"It's almost funny when you think about this from a mitigation perspective," added Reguly. "Older, less powerful systems won't run Aero. So, in a way, having an outdated computer mitigates this vulnerability."

There is no notification on when to expect a patch for this vulnerability. Microsoft also issued a security advisory (983438) in late April for a SharePoint vulnerability, but it is yet to be patched.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Touting Azure for Operators, Microsoft Joins SDN Standards Group

    As part of its Azure for Operators program, Microsoft this week joined a nonprofit standards association that focuses on SDN technologies used by enterprises and service providers.

  • 2020 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss. (Now updated with COVID-19-related event changes.)

  • Pilot Begins of Microsoft Teams-Salesforce CRM Integration

    A new capability that lets Microsoft Teams users access information from the Salesforce.com customer relationship management (CRM) platform debuted this week.

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.