It turns out that Windows did not parse too accurately all the fields and data structures within True Type fonts, and it is therefore possible for a naughty "font" to present invalid information to Windows and making it crash or, theoretically, seizing control and executing malicious code.
And since it's possible to embed a True Type font in a web site, this has some very disturbing implications - especially since most antiviruses don't usually examine fonts too closely. You visit a web site, or perhaps just a web page containing an advertising HTML banner with its own fonts, and bang!, pwn3d.
So quite correctly KB3013455 fixes this, adding several more checks; and naughty fonts can no longer do anything.
Except that... what would happen if some system fonts failed those same checks, or contained information that was slightly off, and nobody had ever realized it because the required checks and settings were never put in place?
It would happen that those slightly and unintentionally naughty fonts, and no others, would suddenly start misbehaving -- reporting to the system sizes and hints that were never reported before. And they would look slightly bad - Arial - or almost unreadable - Courier New.
Until a new fix supplied a "properly behaved" version of both sets of font files (there's eight of them, I think - normal, italic, bold, and bold italic, two each).
That's what happened.
Until the new fix, the choice is:
Replace the two fonts with suitable alternatives in all affected programs. Segoe UI and Consolas work for me (I've also heard good things of a free font called Inconsolata). For some browsers, it is possible to setup a font replacement via plugins or settings. Wait for the fixed fonts to come up. Ideally, it shouldn't take long. In the interim, the PC is protected against a "font attack". RECOMMENDED.
- to fix Firefox: locate the
userContent.css
file in your Firefox profile. If there is no such file, locate the AppData\Mozilla\Firefox\Profiles\RANDOM_STRING\chrome
directory and create a file called userContent.css
. In this file place (or add if it already exists)
@font-face {
font-family: 'Arial'; src: local('Segoe UI');
}
@font-face {
font-family: 'Courier New'; src: local('Consolas');
}
@font-face {
font-family: 'Times New Roman'; src: local('Linux Libertine');
}
(Of course the "local" fonts must be installed!).
Uninstall the KB3013455 fix (and remain vulnerable). Except maybe you can't.
- easy: KB3013455 is present in Control Panel, Applications, [x] Show Updates, Sort by Date, and look for January or February 2015. Uninstall (*). But depending on (#) it might not be there.
- almost as easy: Start > Accessories > System Utilities > System Restore, and restore a previous configuration. You should see "Software Distribution Service". Choose the "System Shutdown" checkpoint before that. Reboot, and you're done (*). Depending on (#) you might not have Restore Points available.
- difficult. Retrieve a copy of
win32k.sys
from before January 2015 from some full backup. Boot from a Linux boot disk or Windows Rescue disk. Rename the existing win32k.sys to win32k.xyz, copy the good win32k.sys into C:\WINDOWS\SYSTEM32, reboot and hope it works.
(*) At the next boot or soon after, the system will ask for an update of one or more packages, and you will need to not install KB3013455 and check "Do not ask me in the future". If (#) forces an update without telling anything, or the fonts look good but revert to being fuzzy after one or more further reboots, (#) is the culprit, but how to make things work out depend on its nature.
(#) Windows XP cannot update since it's end of life. Why is it updating? Because there are ways to keep the thing alive long after it should be dead. One such fix that I found is to have it report being "WEPOS System", a XP flavour used for ATMs that's supported for some more years (?), with a registry "fix". Another way is to have a utility that pulls the updates from somewhere - the WEPOS Windows Update site perhaps, or some virus lord's basement tank - and trick XP into believing it's the official Windows Update service. Whatever it is that updates Windows, you need to tell it to leave KB3013455 alone.
Update: things "fixing/updating" XP you may have to thank for the Arial/Courier/Times mess
This is a list of possible causes of more or less silent update(s) to an end-of-lifed XP:
- The "WEPOS" registry hack.
- Something related to McAfee (reported by @rboblenz). I've found some articles relating to an "unability to update XP", which would seem to imply that McAfee has some ability of updating XP, but nothing clearly stated in their site. Even so, if you have a McAfee product, that might be the explanation.
- A couple of tools that allow(ed) to have a pirated copy of XP and keep it updated and, apparently, keep it updated after EOL downloading updates from... somewhere. (And who wouldn't feel comfortable in trusting their data - bank account credentials possibly included - to such solutions? After all, what's the worst that might happen?)