{"id":17598,"date":"2015-07-22T14:27:45","date_gmt":"2015-07-22T20:27:45","guid":{"rendered":"https://www.webroot.com/blog/?p=17598"},"modified":"2018-01-30T11:11:49","modified_gmt":"2018-01-30T18:11:49","slug":"another-hacking-team-exploit-that-is-critical-for-all-windows-systems-cve-2015-2426","status":"publish","type":"post","link":"https://www.webroot.com/blog/2015\/07\/22\/another-hacking-team-exploit-that-is-critical-for-all-windows-systems-cve-2015-2426\/","title":{"rendered":"Another Hacking Team exploit that is CRITICAL for ALL Windows systems &#8211; CVE-2015-2426"},"content":{"rendered":"<p><img decoding=\"async\" loading=\"lazy\" class=\" wp-image-17600 size-medium alignleft\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2015\/07\/security_exploits-642x428-300x300.png\" alt=\"\" width=\"300\" height=\"300\" srcset=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2015\/07\/security_exploits-642x428-300x300.png 300w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2015\/07\/security_exploits-642x428-150x150.png 150w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2015\/07\/security_exploits-642x428-1024x1024.png 1024w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/>It just doesn&#8217;t seem to end with all the exploits being revealed by the Hacking Team dump earlier this month. This vulnerability could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded OpenType fonts.\u00a0The Adobe Type Manager module contains a memory corruption vulnerability, which can allow an attacker to obtain system\u00a0privileges on an affected Windows system.<\/p>\n<p>Adobe Type Manager, which is provided by <tt>atmfd.dll<\/tt>, is a kernel module that is provided by Windows and provides support for OpenType fonts. A memory-corruption flaw (buffer underflow) in Adobe Type Manager allows for manipulation of Windows kernel memory, which can result in a wide range of impacts. \u00a0This vulnerability can allow an attacker to gain SYSTEM privileges on an affected Windows system. Hackers would use this to infect users systems with any type of malware and gain remote control access if they desired &#8211; all without notifying the user. Also, this vulnerability can be used to bypass web browser and other OS-level sandboxing and protections.<\/p>\n<p>This is a confirmed exploit on Windows XP and up and Windows Server 2003 and up. Since Windows XP and Windows Server 2003 are no longer supported by Microsoft, there is no patch for\u00a0users on those operating systems so we HIGHLY advise that you migrate to a newer operating system. Windows Vista, 7, and 8 users are going to have an update rolled out shortly that will patch this vulnerability so make sure you keep an eye out for updates. More info <a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/security\/ms15-078.aspx\">here<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It just doesn&#8217;t seem to end with all the exploits being revealed by the Hacking Team dump earlier this month. This vulnerability could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded OpenType fonts.\u00a0The Adobe Type Manager module contains a memory corruption vulnerability, which [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":17048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[18785,18773,18797,18779,18789,18791,18793,18783,18777,18801,3819,18795,18775,18787,3471,8925,18799,18781,7887,5743],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/17598"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=17598"}],"version-history":[{"count":6,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/17598\/revisions"}],"predecessor-version":[{"id":17610,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/17598\/revisions\/17610"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17048"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=17598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=17598"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=17598"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=17598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}