Microsoft issues workaround for Duqu attack while it prepares a patch

The temporary fix may affect some applications using embedded fonts, Microsoft said

Microsoft has published code to temporarily blunt attacks against a software vulnerability exploited by Duqu, an advanced piece of malicious software still being closely analyzed by security researchers.

Microsoft is working on a patch for the vulnerability in the Win32k TrueType font parsing engine, a component of various Windows operating systems. An attacker could exploit it to load malicious code on a computer in kernel mode.

The exploit can be delivered by a malicious Microsoft Word document, researchers found. The document could be sent to a target via an e-mail attachment; opening the document would launch the attack.

Researchers from the Laboratory of Cryptography and System Security (CrySyS) in Hungary located an installer file for Duqu and discovered it used the previously unknown Windows vulnerability.

Microsoft's workarounds are a few lines of code that run at an administrative command prompt. Microsoft warned that installing the workarounds may mean that some applications that rely on embedded font technology may not display properly. The workarounds apply to Microsoft's XP, Vista and 7 operating systems as well as to various Windows Server products. The company has also published a quick fix that can be downloaded and applied.

Microsoft is due to release its monthly patches on Tuesday, but it doesn't appear the company will fix the Duqu vulnerability in time. Microsoft also occasionally releases "out-of-cycle" patches for major vulnerabilities, but it typically does not forecast if it will do so.

Microsoft could take weeks to engineer a patch, said Costin G. Raiu, director of the global research and analysis team for Kaspersky Lab.

"Fixing the vulnerability will require modifying the kernel code, which is something very delicate and risky," Rau said. "Testing the modification and patches will take a lot of time."

Creating an out-of-cyle patch could take at least two weeks, Raiu said. It is more likely the patch will be ready next month, unless the bug is reverse-engineered and more malware starts using it, he said.

Duqu has been likened to Stuxnet, although reports have differed over whether the two pieces of malware are related.

Stuxnet demonstrated a certain level of sophistication on the part of its creators, as it installed itself in Windows by exploiting four zero-day vulnerabilities -- ones that are exploited before the vendor is aware of it and able to develop a patch.

Duqu is also viewed as advanced, since exploitation of a kernel-level problem would enable it to better evade antivirus software. Duqu is believed to have been created for targeted attacks against organizations.

"We are aware of targeted attacks that try to use the reported vulnerability; overall, we see low customer impact at this time," Microsoft said in an advisory posted late Thursday.

Despite Microsoft's downplaying of the risk, infections have been detected worldwide, including France, the Netherlands, Switzerland, Ukraine, India, Iran, Sudan and Vietnam, according to security vendor Symantec. Other incidents have occurred in Austria, Hungary, Indonesia and the U.K.

Chester Wisniewski, a senior security advisor at security vendor Sophos in Canada, wrote on a company blog that it's "pretty serious bug."

"I expect Microsoft won't waste too much time getting a fix out for this one," he wrote.

(IDG News Service correspondent Lucian Constantin contributed to this story.)

Send news tips and comments to jeremy_kirk@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags MicrosoftpatchesExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Bitdefender 2019

Bitdefender solutions stop attacks before they even begin! Get cybersecurity that 500 MILLION users already have and trust.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?