So Microsoft's Patch Tuesday lands tomorrow, and I've spent most of today doing something I haven't had to do in a while: manually locking down a bunch of Windows machines by hand because the actual fix isn't out yet.
Quick recap for anyone who missed it. Microsoft disclosed a zero-day in MSHTML — that's the old Trident rendering engine, the thing that used to power Internet Explorer and still gets invoked by Office documents under the hood — back on September 7th. The short version is a malicious Word doc can pull in an ActiveX control that lets an attacker run code on your machine, and you don't even need macros enabled for it to work, which is the part that got my attention. Researchers had working proof-of-concept exploits circulating within days of the advisory going public, and by this week it's being used in the wild, not just in a lab somewhere.
Microsoft's own advisory (ADV210003, if you want to go look it up yourself) doesn't have a patch attached to it yet. What it has instead is a workaround: you disable ActiveX control installation in Internet Explorer by setting the compatibility flag for the relevant CLSIDs in the registry. It's not hard, exactly, it's just tedious, and it's the kind of fix that makes you appreciate how much of Windows security in 2021 still runs on infrastructure nobody's touched since 2007.
What I actually did today
I run a handful of machines for a small business client (a dentist's office, of all things, three front-desk PCs and a back office machine that does billing), and I didn't want to wait around for tomorrow's patch given how easy this exploit apparently is to weaponize. So:
- I pulled the registry values straight from Microsoft's advisory and dropped them into a
.regfile rather than clicking through regedit four separate times. Import once, done. - I also flipped on "always show file extensions" and had a short, slightly awkward conversation with the office manager about not opening attachments from senders she doesn't recognize, even ones that look like invoices. She's heard this speech from me before. I don't think it sticks the second or third time either, honestly, but you say it anyway.
- For my own laptop I went a step further and disabled the Preview Pane and Details Pane in Explorer, since there was some early back-and-forth in the security community about whether just previewing a malicious file could trigger it. Better safe than sorry for an afternoon.
None of this is glamorous work. It's registry edits and a client conversation and double-checking Office is still set to open everything in Protected View by default (leave that one alone, it actually helps here). But it's the kind of thing that happens constantly if you're the person who ends up being IT for people who didn't ask to need one.
What bugs me about this whole class of bug is that we're eight years past when Microsoft told everyone to stop using ActiveX, and it's still sitting there as an attack surface because Office documents can reach into it sideways through the rendering engine. EMET, the old exploit mitigation toolkit that used to catch a lot of this stuff, got retired back in 2018 in favor of Windows Defender Exploit Guard, which is fine, but Exploit Guard's more granular protections are mostly an Enterprise-license feature. A dentist's office running Windows 10 Pro doesn't get the same toolkit a bank does. That gap matters more than people give it credit for.
Anyway. Patch should be out tomorrow as part of the regular September rollup, and I'll pull it onto all four machines the moment it's available rather than waiting for the usual staggered rollout I'd normally tolerate. Tomorrow's also an Apple event day apparently, invites went out last week for something happening at their spaceship campus, so between that and finally getting this MSHTML mess patched it's going to be a two-cups-of-coffee kind of morning.
If you're running any of the affected Office versions and haven't looked at the advisory yet, go do that before you do anything else today. The registry workaround takes ten minutes. Waiting until after something goes wrong takes a lot longer.