Microsoft Security Bulletin MS15-080 - Critical

**For 32-bit systems:**

1.  Enter the following commands at an administrative command prompt:  

       ```
       cd "%windir%\system32"  
       takeown.exe /f atmfd.dll
       icacls.exe atmfd.dll /save atmfd.dll.acl  
       icacls.exe atmfd.dll /grant Administrators:(F)  
       rename atmfd.dll x-atmfd.dll
       ```
        
2.  Restart the system.  

**For 64-bit systems:**

1.  Enter the following commands at an administrative command prompt:  

       ```
       cd "%windir%\system32" 
       takeown.exe /f atmfd.dll  
       icacls.exe atmfd.dll /save atmfd.dll.acl
       icacls.exe atmfd.dll /grant Administrators:(F)
       rename atmfd.dll x-atmfd.dll
       cd "%windir%\syswow64"
       takeown.exe /f atmfd.dll
       icacls.exe atmfd.dll /save atmfd.dll.acl  
       icacls.exe atmfd.dll /grant Administrators:(F)  
       rename atmfd.dll x-atmfd.dll
       ```  
        
2.  Restart the system.  

**Optional procedure for Windows 8 and later operating systems (disable ATMFD):**

**Note** Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.  

**Method 1 (manually edit the system registry):**

1.  Run **regedit.exe** as Administrator.  
2.  In Registry Editor, navigate to the following sub key (or create it) and set its DWORD value to 1:

    HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DisableATMFD, DWORD = 1

3.  Close Registry Editor and restart the system.  

**Method 2 (use a managed deployment script):**

1.  Create a text file named **ATMFD-disable.reg** that contains the following text:  

       ```
       Windows Registry Editor Version 5.00  
       [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]  
       "DisableATMFD"=dword:00000001
       ```  
       
2.  Run **regedit.exe**.  
3.  In Registry Editor, click the **File** menu and then click **Import**.  
4.  Navigate to and select the **ATMFD-disable.reg** file that you created in the first step.  
    (**Note** If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to **All Files**).  
5.  Click **Open** and then click **OK** to close Registry Editor.  

**Impact of workaround.** Applications that rely on embedded font technology will not display properly. Disabling ATMFD.DLL could cause certain applications to stop working properly if they use OpenType fonts. Microsoft Windows does not release any OpenType fonts natively. However, third-party applications could install them and they could be affected by this change.  

**How to undo the workaround.**

**For 32-bit systems:**

1.  Enter the following commands at an administrative command prompt:  

       ```
       cd "%windir%\system32"
       rename x-atmfd.dll atmfd.dll  
       icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"  
       icacls.exe . /restore atmfd.dll.acl
       ```  

2.  Restart the system.  

**For 64-bit systems:**

1.  Enter the following commands at an administrative command prompt:  
        
    ```
    cd "%windir%\system32"  
    rename x-atmfd.dll atmfd.dll  
    icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"  
    icacls.exe . /restore atmfd.dll.acl  
    cd "%windir%\syswow64"  
    rename x-atmfd.dll atmfd.dll  
    icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"  
    icacls.exe . /restore atmfd.dll.acl
    ```  

2.  Restart the system.  

**Optional procedure for Windows 8 and later operating systems (enable ATMFD):**

**Note** Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.  

**Method 1 (manually edit the system registry):**

1.  Run **regedit.exe** as Administrator.  
2.  In Registry Editor, navigate to the following sub key and set its DWORD value to 0:

    HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DisableATMFD, DWORD = 0

3.  Close Registry Editor and restart the system.  

**Method 2 (use a managed deployment script):**

1.  Create a text file named **ATMFD-enable.reg** that contains the following text:  

    `Windows Registry Editor Version 5.00`  
    `[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]`  
    `"DisableATMFD"=dword:00000000`  
        2.  Run **regedit.exe**.  
3.  In Registry Editor, click the **File** menu and then click **Import**.  
4.  Navigate to and select the **ATMFD-enable.reg** file that you created in the first step.  
    (**Note** If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to **All Files**).  
5.  Click **Open** and then click **OK** to close Registry Editor.  

Multiple TrueType Font Parsing Vulnerabilities

Remote code execution vulnerabilities exist when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts. An attacker who successfully exploited these vulnerabilities could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

There are multiple ways an attacker could exploit the vulnerabilities, including by convincing a user to open a specially crafted document or by convincing them to visit an untrusted webpage that contains embedded TrueType fonts.

The update addresses the vulnerabilities by correcting how the Windows DirectWrite library handles TrueType fonts.

The following tables contain links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list: