Microsoft Windows TrueType font parsing vulnerability


### Overview A vulnerability in the Microsoft Windows TrueType font parsing component could allow an attacker to run arbitrary code in kernel mode. This vulnerability is reportedly being exploited by malicious software in the wild known as `Duqu`. ### Description The Microsoft Windows kernel includes a driver (win32k.sys) that handles a variety of graphics processing tasks, including the processing of TrueType fonts. A vulnerability exists in the way this driver handles certain embedded TrueType fonts. This vulnerability could allow an attacker to execute code with elevated privileges on the affected system. A remote attacker could exploit this vulnerability by embedding a specially crafted font in a document attached to an email message or including the crafted font in a web page. --- ### Impact An attacker may be able to run arbitrary code in kernel mode, resulting in complete system compromise. Secondary impacts include, but are not limited to, installation of programs; viewing, changing, or deleting data; or the creation of new system accounts with full privileges. --- ### Solution **Apply an update** Microsoft has addressed this issue in Microsoft Security Bulletin [MS11-087](<http://technet.microsoft.com/en-us/security/bulletin/ms11-087>). Users may also wish to consider applying the following workaround: --- **Deny access to T2EMBED.DLL** Microsoft has published a workaround for this issue in [Microsoft Security Advisory (2639658)](<http://technet.microsoft.com/en-us/security/advisory/2639658>), which recommends denying access to T2EMBED.DLL. Users are encouraged to review this advisory and consider applying the workaround that it describes. Additionally, [Microsoft Knowledge Base Article 2639658](<http://support.microsoft.com/kb/2639658>) contains Microsoft Fix it 50792 and Microsoft Fix it 50793 to help users apply this workaround. --- ### Vendor Information 316553 Filter by status: All Affected Not Affected Unknown Filter by content: __ Additional information available __ Sort by: Status Alphabetical Expand all **Javascript is disabled. Click here to view vendors.** ### Microsoft Corporation Affected Notified: November 02, 2011 Updated: December 19, 2011 **Statement Date: November 04, 2011** ### Status Affected ### Vendor Statement We have not received a statement from the vendor. ### Vendor Information We are not aware of further vendor information regarding this vulnerability. ### Vendor References * <http://technet.microsoft.com/en-us/security/bulletin/ms11-087> * <http://technet.microsoft.com/en-us/security/advisory/2639658> * <http://support.microsoft.com/kb/2639658> ### CVSS Metrics Group | Score | Vector ---|---|--- Base | | Temporal | | Environmental | | ### References <http://secunia.com/advisories/46724/> ### Acknowledgements This document was written by Chad R Dougherty. ### Other Information **CVE IDs:** | [CVE-2011-3402](<http://web.nvd.nist.gov/vuln/detail/CVE-2011-3402>) ---|--- **Severity Metric:** | 26.73 **Date Public:** | 2011-11-02 **Date First Published:** | 2011-11-04 **Date Last Updated: ** | 2011-12-19 12:57 UTC **Document Revision: ** | 14