Microsoft Security Bulletin MS15-097 - Critical

1. Enter the following commands at an administrative command prompt:

    cd "%windir%\system32"  
    takeown.exe /f atmfd.dll  
    icacls.exe atmfd.dll /save atmfd.dll.acl  
    icacls.exe atmfd.dll /grant Administrators:(F)   
    rename atmfd.dll x-atmfd.dll

2. Restart the system.

For 64-bit systems:

1. Enter the following commands at an administrative command prompt:

        cd "%windir%\system32"  
        takeown.exe /f atmfd.dll  
        icacls.exe atmfd.dll /save atmfd.dll.acl  
        icacls.exe atmfd.dll /grant Administrators:(F)   
        rename atmfd.dll x-atmfd.dll  
        cd "%windir%\syswow64"  
        takeown.exe /f atmfd.dll  
        icacls.exe atmfd.dll /save atmfd.dll.acl  
        icacls.exe atmfd.dll /grant Administrators:(F)   
        rename atmfd.dll x-atmfd.dll

2. Restart the system.

Optional procedure for Windows 8 and later operating systems (disable ATMFD):

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

Method 1 (manually edit the system registry):

1. Run regedit.exe as Administrator.

2. In Registry Editor, navigate to the following sub key (or create it) and set its DWORD value to 1:

   HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 1

3. Close Registry Editor and restart the system.

Method 2 (use a managed deployment script):

1. Create a text file named ATMFD-disable.reg that contains the following text:

           Windows Registry Editor Version 5.00  
           [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]  
           "DisableATMFD"=dword:00000001
   

2. Run regedit.exe.

3. In Registry Editor, click the File menu and then click Import.

4. Navigate to and select the ATMFD-disable.reg file that you created in the first step.
   (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).

5. Click Open and then click OK to close Registry Editor.

Impact of workaround. Applications that rely on embedded font technology will not display properly. Disabling ATMFD.DLL could cause certain applications to stop working properly if they use OpenType fonts. Microsoft Windows does not release any OpenType fonts natively. However, third-party applications could install them and they could be affected by this change.

How to undo the workaround.

For 32-bit systems:

1. Enter the following commands at an administrative command prompt:

        cd "%windir%\system32"  
        rename x-atmfd.dll atmfd.dll  
        icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"  
        icacls.exe . /restore atmfd.dll.acl

2. Restart the system.

For 64-bit systems:

1. Enter the following commands at an administrative command prompt:

    cd "%windir%\system32"  
    rename x-atmfd.dll atmfd.dll  
    icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"  
    icacls.exe . /restore atmfd.dll.acl  
    cd "%windir%\syswow64"  
    rename x-atmfd.dll atmfd.dll  
    icacls.exe atmfd.dll /setowner "NT SERVICE\TrustedInstaller"  
    icacls.exe . /restore atmfd.dll.acl

2. Restart the system.

Optional procedure for Windows 8 and later operating systems (enable ATMFD):

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

Method 1 (manually edit the system registry):

1. Run regedit.exe as Administrator.

2. In Registry Editor, navigate to the following sub key and set its DWORD value to 0:

   HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\DisableATMFD, DWORD = 0

3. Close Registry Editor and restart the system.

Method 2 (use a managed deployment script):

1. Create a text file named ATMFD-enable.reg that contains the following text:

    Windows Registry Editor Version 5.00  
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]  
    "DisableATMFD"=dword:00000000

2. Run regedit.exe.
3. In Registry Editor, click the File menu and then click Import.
4. Navigate to and select the ATMFD-enable.reg file that you created in the first step.
   (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
5. Click Open and then click OK to close Registry Editor.

Multiple Font Driver Elevation of Privilege Vulnerabilities

Elevation of privilege vulnerabilities exist in Microsoft Windows when the Windows Adobe Type Manager Library fails to properly handle objects in memory. An attacker who successfully exploited the vulnerabilities could execute arbitrary code and take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit these vulnerabilities, an attacker would first have to log on to a target system and then run a specially crafted application. The security update addresses the vulnerabilities by correcting how ATMFD handles objects in memory.

The following tables contain links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list: