Vulnerability Note VU#316553
Microsoft Windows TrueType font parsing vulnerability
A vulnerability in the Microsoft Windows TrueType font parsing component could allow an attacker to run arbitrary code in kernel mode. This vulnerability is reportedly being exploited by malicious software in the wild known as Duqu.
The Microsoft Windows kernel includes a driver (win32k.sys) that handles a variety of graphics processing tasks, including the processing of TrueType fonts. A vulnerability exists in the way this driver handles certain embedded TrueType fonts. This vulnerability could allow an attacker to execute code with elevated privileges on the affected system.
A remote attacker could exploit this vulnerability by embedding a specially crafted font in a document attached to an email message or including the crafted font in a web page.
An attacker may be able to run arbitrary code in kernel mode, resulting in complete system compromise. Secondary impacts include, but are not limited to, installation of programs; viewing, changing, or deleting data; or the creation of new system accounts with full privileges.
Apply an update
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||02 Nov 2011||19 Dec 2011|
CVSS Metrics (Learn More)
This document was written by Chad R Dougherty.
- CVE IDs: CVE-2011-3402
- Date Public: 02 Nov 2011
- Date First Published: 04 Nov 2011
- Date Last Updated: 19 Dec 2011
- Severity Metric: 26.73
- Document Revision: 14
If you have feedback, comments, or additional information about this vulnerability, please send us email.