News

Microsoft Issues Security Advisory on Windows Aero

Microsoft released a security advisory on Tuesday concerning a Windows component involved with desktop graphics display.

At issue is what Redmond calls a "publicly disclosed" remote code execution exploit in the Canonical Display Driver (cdd.dll), a Windows component used for desktop composition. It only affects systems that have enabled the Windows Aero graphics theme. The advisory (2028859) pertains to Windows 7 64-bit, Windows Server 2008 R2 for 64-bit systems and Windows Server 2008 R2 Itanium operating systems.

The cdd.dll driver is used to blend graphic device interfaces and DirectX drawing, according to Microsoft's advisory. The exploit could be triggered when or if the Canonical Display Driver does not properly parse data copied from user mode to kernel mode within Windows 7.

The attack scenario associated with this cdd.dll vulnerability is still largely theoretical, according to Microsoft's advisory.

"Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)," the advisory notes.

Microsoft said it is working on a patch but wasn't aware of any in-the-wild exploits. More to the point, Redmond said it will "release the security update once it has reached an appropriate level of quality for broad distribution."

Unlike past security advisories, Microsoft did not say there might be an out-of-band patch. Security experts don't expect one because of the highly technical nature of this exploit.

"If I were to take a guess, I'd say that it's unlikely that we'll see effective exploit code that will target a large user base, and that's if we see exploit code at all," said Tyler Reguly, lead security research engineer at nCircle. "For these reasons, I don't expect this issue to be patched out-of-band by Microsoft. It will probably be rolled into their regular patch cycle and released at some point in the future."

In the meantime, customers can help protect themselves against potential threats against the Windows Canonical Display Driver by disabling Windows Aero, the graphics display theme introduced with Windows Vista. Microsoft says that with Windows Aero disabled, the path by which cdd.dll can be exploited is bypassed.

"It's almost funny when you think about this from a mitigation perspective," added Reguly. "Older, less powerful systems won't run Aero. So, in a way, having an outdated computer mitigates this vulnerability."

There is no notification on when to expect a patch for this vulnerability. Microsoft also issued a security advisory (983438) in late April for a SharePoint vulnerability, but it is yet to be patched.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • The 2019 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generation of HoloLens, here's what's on tap from Microsoft this year.

  • 2019 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss this year.

  • Microsoft Ends Development on Windows To Go

    The May 2019 update of Windows 10, also known as version 1903, will be the last Windows client OS to have support for Windows To Go.

  • Microsoft Finally Releases Hyper-V Server 2019

    Conceding that it has taken "way too long," Microsoft has announced that Hyper-V Server 2019 is now available for download.