Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Publish Date : 2011-11-04 Last Update Date : 2013-03-06
OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify
a vulnerability or a missing patch. Check out the OVAL definitions
if you want to learn what you should do to verify a vulnerability.
http://www.us-cert.gov/cas/techalerts/TA12-129A.html
CERT TA12-129A |
http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit
|
http://www.securitytracker.com/id?1027039
SECTRACK 1027039 |
http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two
|
http://secunia.com/advisories/49122
SECUNIA 49122 |
http://secunia.com/advisories/49121
SECUNIA 49121 |
http://isc.sans.edu/diary/Duqu+Mitigation/11950
|
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf
|
http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx CONFIRM
|
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf
|
http://technet.microsoft.com/en-us/security/advisory/2639658
Microsoft Advisory http://technet.microsoft.com/security/advisory/2639658 Microsoft Security Advisory (2639658): Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege - Version: 2.0
Revision Note: V2.0 (December 13, 2011): Advisory updated to reflect publication of security bulletins.
Summary: Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS11-087 to address this issue. For more information about this issue, including download links for an available security update, please review MS11-087. The vulnerability addressed is the TrueType Font Parsing Vulnerability - CVE-2011-3402.Release Date:2011-12-13 |
http://technet.microsoft.com/en-us/security/bulletin/ms11-087
Microsoft Security Bulletin MS11-087 MS11-087 - Critical : Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2639417) - Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (December 13, 2011): Bulletin published.
Summary: This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted document or visits a malicious Web page that embeds TrueType font files.Release Date:2011-12-13 |
http://technet.microsoft.com/en-us/security/bulletin/ms12-034
Microsoft Security Bulletin MS12-034 MS12-034 - Critical : Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight (2681578) - Version: 1.6
Severity Rating: Critical
Revision Note: V1.6 (March 6, 2013): Corrected update replacement information for the KB2676562 update.
Summary: This security update resolves three publicly disclosed vulnerabilities and seven privately reported vulnerabilities in Microsoft Office, Microsoft Windows, the Microsoft .NET Framework, and Microsoft Silverlight. The most severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits a malicious webpage that embeds TrueType font files. An attacker would have no way to force users to visit a malicious website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's website.Release Date:2013-03-06 |
http://technet.microsoft.com/en-us/security/bulletin/ms12-039
Microsoft Security Bulletin MS12-039 MS12-039 - Important : Vulnerabilities in Lync Could Allow Remote Code Execution (2707956) - Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (June 12, 2012): Bulletin published.
Summary: This security update resolves one publicly disclosed vulnerability and three privately reported vulnerabilities in Microsoft Lync. The most severe vulnerabilities could allow remote code execution if a user views shared content that contains specially crafted TrueType fonts.Release Date:2012-06-12 |
http://www.us-cert.gov/cas/techalerts/TA11-347A.html
CERT TA11-347A |
http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files
|
http://www.us-cert.gov/cas/techalerts/TA12-164A.html
CERT TA12-164A |
