CERT-In Vulnerability Note
CIVN-2015-0302
Remote Code Execution Vulnerability in Microsoft Windows Uniscribe
Original Issue Date:December 09, 2015
Severity Rating: HIGH
Software Affected
- Windows 7 Service Pack 1 (32 bit and 64 bit systems)
- Windows Server 2008 R2 Service Pack 1 (64 based and Itanium based systems)
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Overview
A remote code execution vulnerability has been reported in Microsoft Windows Uniscribe which could be exploited by an attacker to execute arbitrary code and cause denial of service conditions on the targeted system.
Description
This vulnerability exists in Microsoft Windows Uniscribe due to improper parsing of specially crafted fonts. Uniscribe is a set of APIs that allow a high amount of control for fine typography and for processing complex scripts. An attacker could exploit this vulnerability by creating a specially crafted web page and enticing the user to visit this page.
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the targeted system, install software and view, change, or delete data or create new accounts with admin rights. Failed attempt of the attacker could also cause denial of service conditions.
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS15-130
Vendor Information
Microsoft
https://technet.microsoft.com/en-us/library/security/ms15-130
References
Microsoft
https://technet.microsoft.com/en-us/library/security/ms15-130
Symantec
https://www.symantec.com/security_response/vulnerability.jsp?bid=78500
CVE Name
CVE-2015-6130
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|