Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

The remote Windows host is potentially affected by the following vulnerabilities :

  - Multiple code execution vulnerabilities exist in the     handling of specially crafted TrueType font files.
    (CVE-2011-3402, CVE-2012-0159)

  - An insecure library loading vulnerability exists in the     way that Microsoft Lync handles the loading of DLL     files. (CVE-2012-1849)

  - An HTML sanitization vulnerability exists in the way     that HTML is filtered. (CVE-2012-1858)

The version of Microsoft Silverlight installed on the remote host is reportedly affected by several vulnerabilities :

  - Incorrect handling of TrueType font (TTF) files could     lead to arbitrary code execution. (CVE-2011-3402 /     CVE-2012-0159)

  - A double-free condition leading to arbitrary code     execution could be triggered when rendering specially     crafted XAML glyphs. (CVE-2012-0176)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Win32k TrueType font parsing engine     that allows an unauthenticated, remote attacker to     execute arbitrary code by convincing a user to open a     Word document containing malicious font data.
    (CVE-2011-3402)

  - A flaw exists in the t2embed.dll module when parsing     TrueType fonts. An unauthenticated, remote attacker can     exploit this, via a crafted TTF file, to execute     arbitrary code. (CVE-2012-0159)

  - A flaw exists in the .NET Framework due to a buffer     allocation error when handling an XBAP or .NET     application. An unauthenticated, remote attacker can     exploit this, via a specially crafted application, to     execute arbitrary code. (CVE-2012-0162)

  - A flaw exists in the .NET Framework due to an error     when comparing the value of an index in a WPF     application. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2012-0164)

  - A flaw exists in GDI+ when handling specially crafted     EMF images that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2012-0165)

  - A heap buffer overflow condition exists in Microsoft     Office in the GDI+ library when handling EMF images     embedded in an Office document. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code by convincing a user to open a specially crafted     document. (CVE-2012-0167)

  - A double-free error exists in agcore.dll when rendering     XAML strings containing Hebrew Unicode glyphs of certain     values. An unauthenticated, remote attacker can exploit     this to execute arbitrary code by convincing a user to     visit a specially crafted web page. (CVE-2012-0176)

  - A privilege escalation vulnerability exists in the     way the Windows kernel-mode driver manages the functions     related to Windows and Messages handling. A local     attacker can exploit this, via a specially crafted     application, to gain elevated privileges.
    (CVE-2012-0180)

  - A privilege escalation vulnerability exists in the way     the Windows kernel-mode driver manages Keyboard Layout     files. A local attacker can exploit this, via a     specially crafted application, to gain elevated     privileges. (CVE-2012-0181)

  - A privilege escalation vulnerability exists in the way     the Windows kernel-mode driver manages scrollbar     calculations. A local attacker can exploit this, via a     specially crafted application, to gain elevated     privileges. (CVE-2012-1848)

The remote host is running a version of the Windows kernel that is affected by a remote code execution vulnerability.  Specially crafted TrueType fonts are not properly handled, which could allow arbitrary code execution in kernel mode.  A remote attacker could exploit this vulnerability by tricking a user into viewing a specially crafted TrueType font (e.g., via web or email).

This vulnerability is reportedly being exploited in the wild by the Duqu malware.

ID	Name	Product	Family	Severity
59457	MS12-039: Vulnerabilities in Lync Could Allow Remote Code Execution (2707956)	Nessus	Windows : Microsoft Bulletins	high
59045	MS12-034: Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578) (Mac OS X)	Nessus	MacOS X Local Security Checks	high
59042	MS12-034: Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578)	Nessus	Windows : Microsoft Bulletins	high
57273	MS11-087: Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2639417)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2011-3402

high

Tenable Plugins

high

high

high

high