CERT-In Vulnerability Note
CIVN-2012-0111
Multiple Vulnerabilities in Microsoft Windows Kernel-Mode Drivers
Original Issue Date:November 14, 2012
Severity Rating: HIGH
Systems Affected
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for 32-bit Systems Service Pack 1
- Windows 7 for x64-based Systems
- Windows 7 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
- Windows 8 for 32-bit Systems
- Windows 8 for 64-bit Systems
- Windows Server 2012
- Windows RT
Overview
Multiple vulnerabilities have been reported in the Microsoft Windows kernel-mode drivers, which could be exploited by attackers to execute arbitrary code in kernel mode to gain elevated privileges on targeted systems.
Description
1. Multiple Win32k Use-After-Free Privilege Escalation Vulnerabilities
(
CVE-2012-2530
CVE-2012-2553
)
The vulnerabilities exist in the Microsoft Windows due to which Windows kernel-mode driver improperly handles objects in memory. A local attacker could exploit these vulnerabilities by running a arbitrary code in kernel mode. Successful exploitation of these vulnerabilities could allow a local attacker to gain elevated privileges on a targeted system with full administrative rights.
2. TrueType Font Parsing Vulnerability
(
CVE-2012-2897
)
The vulnerability is caused when Windows fails to properly handle specially crafted TrueType Fonts (TTF). The vulnerability could allow remote code execution if a user opens a specially crafted TrueType font file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS12-075
Vendor Information
Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms12-075
References
Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms12-075
Security Focus
http://www.securityfocus.com/bid/56457
Security Tracker
http://www.securitytracker.com/id/1027750
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=27361
http://tools.cisco.com/security/center/viewAlert.x?alertId=27362
http://tools.cisco.com/security/center/viewAlert.x?alertId=27363
CVE Name
CVE-2012-2530
CVE-2012-2553
CVE-2012-2897
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|