Baku, July 22 AZERTAC

Microsoft has released an emergency update to patch a security bug that allows attackers to remotely execute malicious code on computers running every supported version of Windows, the company said.

The critical vulnerability, which is present in all supported version of Windows, involves the way the Windows Adobe Type Manager Library handles fonts that use Microsoft's OpenType format. The bug allows attackers to take complete control of vulnerable computers. Attackers can exploit it by luring targets to booby-trapped websites or by tricking a target into opening a malicious file.

There are no indications at the moment that the vulnerability is being actively exploited in the wild. Still, the unscheduled issuance on Monday is an indication that the chances of exploitation are high enough to merit installation as soon as possible.

"When this security bulletin was issued, Microsoft had information to indicate that this vulnerability was public but did not have any information to indicate this vulnerability had been used to attack customers," Microsoft officials wrote in an advisory published Monday. "Our analysis has shown that exploit code could be created in such a way that an attacker could consistently exploit this vulnerability."

The easiest way to close the security hole is to use Windows Update to install the patch. For organizations where immediate patching isn't an option, Microsoft's advisory recommended several workarounds. The update isn't available for Windows Server 2003, which as of last week no longer receives support.

The patch comes six days after Microsoft fixed a separate vulnerability in the Adobe Type Manager Font Driver. Despite the similarity to the Windows Adobe Type Manager Library being patched in Monday's emergency release, this appears to be a separate bug. The earlier security bug became public knowledge following the breach two weeks ago of Hacking Team networks and has been actively exploited in the wild, presumably in combination with an Adobe Flash exploit, so attackers could break out of the Google Chrome security sandbox and achieve remote code execution.​