CERT-In Vulnerability Note
CIVN-2012-0114
Remote Code Execution Vulnerabilities in Windows Kernel-Mode Drivers
Original Issue Date:December 12, 2012
Severity Rating: HIGH
Systems Affected
- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32-bit Systems SP2
- Windows Server 2008 for x64-based Systems SP2
- Windows Server 2008 for Itanium-based Systems SP2
- Windows 7 for 32-bit Systems SP1 and prior
- Windows 7 for x64-based Systems SP1 and prior
- Windows Server 2008 R2 for x64-based Systems SP1 and prior
- Windows Server 2008 R2 for Itanium-based Systems SP1 and prior
- Windows 8 (32-bit and 64-bit) Systems
- Windows Server 2012
- Windows RT
Overview
Multiple vulnerabilities have been reported in Windows Kernel-Mode drivers that could allow a remote attacker to execute arbitrary code on a targeted system. Successful exploitation could result in a complete comprise of the targeted system.
Description
1. Microsoft Windows OpenType Font Processing Arbitrary Code Execution Vulnerability
(
CVE-2012-2556
)
This vulnerability exists in Microsoft Windows OpenType due to improper handling of objects in memory. The vulnerability could be exploited by a remote attacker by sending a crafted OpenType font files and enticing a user to open the crafted file. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code and can take complete control of the system. Workaround - Disable the WebClient service
- Block TCP ports 139 and 445 at the firewall
- Disable the Preview Pane and Details Pane in Windows Explorer
2. Microsoft Windows TrueType Font Processing Arbitrary Code Execution Vulnerability
(
CVE-2012-4786
)
This vulnerability exists in Microsoft Windows TrueType Font due to the improper handling of TrueType font files. The vulnerability can be exploited by a remote attacker by sending a crafted TrueType Font files and enticing a user to open the crafted file. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code and can take complete control of the system. Workaround - Disable the WebClient service
- Block TCP ports 139 and 445 at the firewall
- Disable the Preview Pane and Details Pane in Windows Explorer
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS12-078
Vendor Information
Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms12-078
References
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=27538
http://tools.cisco.com/security/center/viewAlert.x?alertId=27539
SecurityFocus
http://www.securityfocus.com/bid/56841
http://www.securityfocus.com/bid/56842
CVE Name
CVE-2012-4786
CVE-2012-2556
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|