HIGH Microsoft Corporation Vulnerability Alert

Product:

TrueType font parsing engine

Summary

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. This vulnerability affects multiple versions of Microsoft Windows, including XP, Vista, and Windows 7. It was exploited in the wild in November 2011 by the Duqu malware.

Details

Severity Base Score CVE
HIGH 8.8 CVE-2011-3402

Exploitation

To exploit this vulnerability, an attacker can create a specially crafted font file and embed it in a Word document or a web page. When the victim opens the document or visits the web page, the crafted font data is processed by the vulnerable TrueType font parsing engine, allowing the attacker to execute arbitrary code on the victim’s system without requiring any user authentication.

Affected Products

  • Microsoft Windows XP SP2 and SP3: Vulnerable to remote code execution via crafted font data.
  • Windows Server 2003 SP2: Affected by the same vulnerability allowing arbitrary code execution.
  • Windows Vista SP2: Vulnerable to exploitation through malicious font files.
  • Windows Server 2008 SP2, R2, and R2 SP1: At risk of remote attacks via crafted font data.
  • Windows 7 Gold and SP1: Can be exploited through specially crafted documents or web pages.

Mitigation

To mitigate this vulnerability, users should apply the latest security updates provided by Microsoft. Additionally, users should avoid opening untrusted documents or visiting suspicious web pages that may contain malicious font data. Implementing security measures such as antivirus software and firewalls can also help protect against potential exploitation.

References