Vulnerability

CERT-In Vulnerability Note CIVN-2011-0180
Microsoft Windows win32k.sys TrueType Font Parsing Vulnerability

Original Issue Date:December 14, 2011

Severity Rating: HIGH

Systems Affected

Windows XP SP3
Windows XP Professional x64 Edition SP2
Windows Server 2003 SP2
Windows Server 2003 x64 Edition SP2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista SP2
Windows Vista x64 Edition SP2
Windows Server 2008 for 32-bit Systems SP2 (Server Core installation not affected)
Windows Server 2008 for x64-based Systems SP2 (Server Core installation not affected)
Windows Server 2008 for Itanium-based Systems SP2
Windows 7 for 32-bit Systems SP1 and prior
Windows 7 for x64-based Systems SP1 and prior
Windows Server 2008 R2 for x64-based Systems SP1 (Server Core installation not affected) and prior
Windows Server 2008 R2 for Itanium-based Systems SP1 and prior

Overview

A vulnerability has been reported in Microsoft Windows kernel, mode driver Win32k.sys which can be exploited by malicious people to compromise a user's system.

Description

The vulnerability is due to improper processing of malformed TrueType fonts by the T2EMBED.DLL library of the Win32k TrueType font parsing engine. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious Microsoft Word document (.doc), embedded with malformed TrueType font resulting in execution of arbitrary code on the system with the privileges of the user.

It has been reported that this vulnerability is being exploited in the wild by W32.Duqu

Workaround

Deny access to T2EMBED.DLL

Use caution when opening attachments in email messages from suspicious or unrecognized sources.

Maintain up-to-date antivirus software.
Note: For detailed steps and impact of applying these workarounds refer to Microsoft Security Bulletin MS11-087

Solution
Apply appropriate patches as mentioned in MS11-087

Vendor Information

Microsoft Corporation
http://technet.microsoft.com/en-us/security/bulletin/MS11-087
http://technet.microsoft.com/en-us/security/advisory/2639658

References

Microsoft Corporation
http://technet.microsoft.com/en-us/security/advisory/2639658

SecurityTracker
http://securitytracker.com/id/1026271

Secunia
http://secunia.com/advisories/46724

CVE Name
CVE-2011-3402

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India