Microsoft Issues Security Advisory on Windows Aero

Microsoft released a security advisory on Tuesday concerning a Windows component involved with desktop graphics display.

At issue is what Redmond calls a "publicly disclosed" remote code execution exploit in the Canonical Display Driver (cdd.dll), a Windows component used for desktop composition. It only affects systems that have enabled the Windows Aero graphics theme. The advisory (2028859) pertains to Windows 7 64-bit, Windows Server 2008 R2 for 64-bit systems and Windows Server 2008 R2 Itanium operating systems.

The cdd.dll driver is used to blend graphic device interfaces and DirectX drawing, according to Microsoft's advisory. The exploit could be triggered when or if the Canonical Display Driver does not properly parse data copied from user mode to kernel mode within Windows 7.

The attack scenario associated with this cdd.dll vulnerability is still largely theoretical, according to Microsoft's advisory.

"Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)," the advisory notes.

Microsoft said it is working on a patch but wasn't aware of any in-the-wild exploits. More to the point, Redmond said it will "release the security update once it has reached an appropriate level of quality for broad distribution."

Unlike past security advisories, Microsoft did not say there might be an out-of-band patch. Security experts don't expect one because of the highly technical nature of this exploit.

"If I were to take a guess, I'd say that it's unlikely that we'll see effective exploit code that will target a large user base, and that's if we see exploit code at all," said Tyler Reguly, lead security research engineer at nCircle. "For these reasons, I don't expect this issue to be patched out-of-band by Microsoft. It will probably be rolled into their regular patch cycle and released at some point in the future."

In the meantime, customers can help protect themselves against potential threats against the Windows Canonical Display Driver by disabling Windows Aero, the graphics display theme introduced with Windows Vista. Microsoft says that with Windows Aero disabled, the path by which cdd.dll can be exploited is bypassed.

"It's almost funny when you think about this from a mitigation perspective," added Reguly. "Older, less powerful systems won't run Aero. So, in a way, having an outdated computer mitigates this vulnerability."

There is no notification on when to expect a patch for this vulnerability. Microsoft also issued a security advisory (983438) in late April for a SharePoint vulnerability, but it is yet to be patched.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Ups Its Windows 10 App Compatibility Assurances

    Microsoft gave assurances this week that organizations adopting Windows 10 likely won't face application compatibility issues.

  • SharePoint Online Users To Get 'Modern' UI Push in April

    Microsoft plans to alter some of the tenant-level blocking capabilities that may have been set up by organizations and deliver its so-called "modern" user interface (UI) to Lists and Libraries for SharePoint Online users, starting in April.

  • How To Use PowerShell Splatting

    Despite its weird name, splatting can be a really handy technique if you create a lot of PowerShell scripts.

  • New Microsoft Customer Agreement for Buying Azure Services To Start in March

    Microsoft will have a new approach for organizations buying Azure services called the "Microsoft Customer Agreement," which will be available for some customers starting as early as this March.

comments powered by Disqus
Most   Popular

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.