KB3013455 (MS15-010) causes font corruption

I am flabbergasted that the advice here is to uninstall a patch for a critical vulnerability that could lead to customers machines being infected with malicious software that could result in a them being exposed to data loss, theft, ransomed data or running a hijacked machine used for all manner of illegal purposes.

I am also astonished that a fault such as this couldn't be fixed and properly tested within 90 days of notice.

I, for one, won't uninstall any security update, but have changed fonts in applications and the system where possible and convenient. There are still a few applications, email, etc, where the font is a little shaky, but it's a small price to pay to keep an affected system up to date.  Also, I continue to hope Microsoft will present a solution, as I'm sure they're well aware of the problem by now.

(Security tech)

Fine, then come up with a better suggestion.

We don't control Microsoft.

None of the issues are in active attack at this time.  So attackers first have to code up something to take advantage of this. 

Given that there is a ton of other stuff (zero day flash) they can attack us with we have time to put pressure on Microsoft to fix this for these platforms.

Of the items that you will have no protection for the true type one has the most risk.

Even then, again as stated in the bulletin "When this security bulletin was originally issued Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers. "

The clock is ticking yes, but if someone has to choose between getting their job done, then pull off this update and surf carefully.

This was not a Google disclosed item that I see so I'm not sure how long it took to code.

  The google disclosed one is the OTHER patch as I read it  3023562 which maps to **CNG Security Feature Bypass Vulnerability - CVE-2015-0010**  which per https://technet.microsoft.com/library/security/dn903755.aspx is the Google one.

This is one of the vulns not protected for if you pull off the update.

TrueType Font Parsing Remote Code Execution Vulnerability - CVE-2015-0059

A remote code execution vulnerability exists in the Windows kernel-mode driver (Win32k.sys) that is caused when it improperly handles TrueType fonts.

An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights. To exploit the vulnerability, an attacker would need to convince a user to open a specially crafted document or visit an untrusted website that contains embedded TrueType Fonts. The update addresses the vulnerability by correcting how the kernel-mode driver handles TrueType fonts.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was originally issued Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

The following workarounds may be helpful in your situation:

• Deny access to T2EMBED.DLL For 32-bit systems, enter the following commands at an administrative command prompt:

Copy

Takeown.exe /f "%windir%\system32\t2embed.dll" Icacls.exe "%windir%\system32\t2embed.dll" /deny everyone:(F)

For 64-bit systems, enter the following commands at an administrative command prompt:

Copy

Takeown.exe /f "%windir%\system32\t2embed.dll" Icacls.exe "%windir%\system32\t2embed.dll" /deny everyone:(F) Takeown.exe /f "%windir%\syswow64\t2embed.dll" Icacls.exe "%windir%\syswow64\t2embed.dll" /deny everyone:(F)

**Impact of workaround.** Applications that rely on embedded font technology will fail to display properly.