Microsoft Issues Security Advisory on Windows Aero

Microsoft released a security advisory on Tuesday concerning a Windows component involved with desktop graphics display.

At issue is what Redmond calls a "publicly disclosed" remote code execution exploit in the Canonical Display Driver (cdd.dll), a Windows component used for desktop composition. It only affects systems that have enabled the Windows Aero graphics theme. The advisory (2028859) pertains to Windows 7 64-bit, Windows Server 2008 R2 for 64-bit systems and Windows Server 2008 R2 Itanium operating systems.

The cdd.dll driver is used to blend graphic device interfaces and DirectX drawing, according to Microsoft's advisory. The exploit could be triggered when or if the Canonical Display Driver does not properly parse data copied from user mode to kernel mode within Windows 7.

The attack scenario associated with this cdd.dll vulnerability is still largely theoretical, according to Microsoft's advisory.

"Code execution, while possible in theory, would be very difficult due to memory randomization both in kernel memory and via Address Space Layout Randomization (ASLR)," the advisory notes.

Microsoft said it is working on a patch but wasn't aware of any in-the-wild exploits. More to the point, Redmond said it will "release the security update once it has reached an appropriate level of quality for broad distribution."

Unlike past security advisories, Microsoft did not say there might be an out-of-band patch. Security experts don't expect one because of the highly technical nature of this exploit.

"If I were to take a guess, I'd say that it's unlikely that we'll see effective exploit code that will target a large user base, and that's if we see exploit code at all," said Tyler Reguly, lead security research engineer at nCircle. "For these reasons, I don't expect this issue to be patched out-of-band by Microsoft. It will probably be rolled into their regular patch cycle and released at some point in the future."

In the meantime, customers can help protect themselves against potential threats against the Windows Canonical Display Driver by disabling Windows Aero, the graphics display theme introduced with Windows Vista. Microsoft says that with Windows Aero disabled, the path by which cdd.dll can be exploited is bypassed.

"It's almost funny when you think about this from a mitigation perspective," added Reguly. "Older, less powerful systems won't run Aero. So, in a way, having an outdated computer mitigates this vulnerability."

There is no notification on when to expect a patch for this vulnerability. Microsoft also issued a security advisory (983438) in late April for a SharePoint vulnerability, but it is yet to be patched.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Bolsters Windows IoT with NXP and SQL Server Support

    Microsoft's Internet of Things (IoT) product line is continuing to grow, with a few new developments highlighted this week.

  • Tamper Protection Now Available to Microsoft Defender ATP Subscribers

    The Microsoft Defender Advanced Threat Protection (ATP) E5 subscription plan now has an optional "tamper protection" security feature, Microsoft announced on Monday.

  • Exploring OCR, a New Way To Get Data into Excel

    Microsoft recently added a new optical character recognition feature to Excel that lets users import data from a photograph taken from a smartphone. Here's how to use it.

  • Microsoft Authenticator App To Get Real-Time Phishing Protections

    Microsoft is working on adding capabilities to its Microsoft Authenticator app to help defeat security breaches enabled by advanced attack techniques, including phishing and man-in-the-middle methods.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.