NEW: Microsoft Vulnerabilities Report 2022 - Read the Findings of Our Annual Report Read Now

  • Partners
  • Support
  • Careers
  • English
    • Deutsch
    • français
    • español
    • 한국어
    • português
BeyondTrust
  • Products

    Privileged Password Management

    Discover, manage, audit, and monitor privileged accounts and credentials.

    • Password Safe
    • DevOps Secrets Safe
    • Privileged Access Discovery Application

    Endpoint Privilege Management

    Enforce least privilege across Windows, Mac, Linux, and Unix endpoints.

    • Windows and Mac
    • Unix and Linux
    • Active Directory Bridge

    Secure Remote Access

    Centrally manage remote access for service desks, vendors, and operators.

    • Remote Support
    • Privileged Remote Access
    • Privileged Access Discovery Application

    Cloud Security Management

    Automate the management of identities and assets across your multicloud footprint.

    • Cloud Privilege Broker

    BeyondInsight

    Experience the industry’s most innovative, comprehensive platform for privileged access management.

  • Solutions

    Use Cases

    • Cloud Security
    • Compliance
    • Cyber Insurance
    • Digital Transformation
    • Endpoint Security
    • Operational Technology
    • Ransomware
    • Service Desk Efficiency
    • Zero Trust

    Industry Applications

    • Financial Services
    • Government Agencies
    • Healthcare
    • Law Enforcement
    • Manufacturing
    • Schools & Universities

    Solutions

    The BeyondTrust Privileged Access Management portfolio is an integrated solution that provides visibility and control over all privileged accounts and users.

  • Resources

    Learn

    • Blog
    • Customer Stories
    • Competitor Comparisons
    • Datasheets
    • Demos
    • Glossary
    • Podcast
    • Whitepapers

    Attend

    • Events
    • Go Beyond
    • Training
    • Webinars

    Support

    • Changelog
    • Professional Services
    • Technical Documentation

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

  • Company
    • About
    • Leadership
    • Core Values
    • Partners
    • Careers
  • Watch Demo
  • Contact Sales

Tagged Image File Format (TIFF) – The Latest MS Vulnerability to hit the Market

October 20, 2017

  • Blog
  • Archive

As the dust settles on the notorious IE zero-day exploit which was fixed in October’s Patch Tuesday, a fresh zero-day utilizing Tagged Image File Format (TIFF) files makes an appearance.

Amidst the many Microsoft vulnerabilities which appear every month, it would seem to be a growing trend that one or two will, figuratively speaking, rise to prominence above the others. Chiefly, this has been the TIFF exploit which is currently affecting various Microsoft products such as Office 2003 – 2007, Windows Vista, Windows Server 2003 and Microsoft Lync.

Although the vulnerability doesn’t affect the latest versions of Microsoft software – think Windows 8, Office 2013, Windows Server 2008 – that will hardly be comforting to those who still use the preceding versions.

Nevertheless, there is a bit of user interaction required for the vulnerability to be successfully exploited. A system cannot be compromised without the user opening or previewing specially crafted content, such as an engineered web page or email attachment. If a user is lured into accessing this content, a flaw in the handling of TIFF image files by the graphics processing components of the affected software will allow an attacker to execute code with the same privileges as the logged-in user. This of course could be particularly damaging if the user were to have administrator privileges, as opposed to a standard user account.

So far, Microsoft is only aware of attacks on Office 2007, mainly in the Middle East and South Asia regions where Windows XP was the operating system. In these targeted attacks, users were asked to open a Word attachment with the malformed image embedded inside.

No patch available as yet

Unfortunately, Microsoft have stated that they will not be releasing a patch for this vulnerability in today’s round of Patch Tuesday fixes, which includes 8 Bulletins. However, Microsoft are actively working on a resolution which will be released when ready, indicating that there may be an out-of-cycle update on the horizon.

In the meantime, whilst not intended as a replacement for the upcoming update, Microsoft has provided a temporary ‘Fix It’ solution via Security Advisory 2896666 which is recommended to help protect systems.

Bearing in mind that there will not be a fix provided today, users are encouraged to exercise caution when invited to unknown websites and receiving unexpected email attachments.

Photograph of Kris Zentek

Kris Zentek, Senior Product Manager

Kris Zentek is a Senior Product Manager at BeyondTrust, focusing on Endpoint Privilege Management solutions. Based in the UK, he has over 20 years of experience working in the cybersecurity industry.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Whitepapers

Microsoft Vulnerabilities Report 2022

Whitepapers

Cybersecurity Insurance Checklist

Whitepapers

Privileged Access Management: PAM Checklist

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support
  • Cloud Privilege Broker

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Podcast
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press
BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2022 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.