Listen to this Post
The vulnerability exists within the win32k.sys kernel-mode driver’s parsing of specially crafted TrueType font (TTF) files. When a malicious TTF font is embedded within a Word document or web page, the Windows kernel fails to properly handle the structure of the font data during parsing. This flawed parsing logic creates a memory corruption condition, specifically a kernel pool buffer overflow. By meticulously designing the font data, an attacker can control the overflow to overwrite critical kernel-mode memory. This control allows for arbitrary code execution with elevated SYSTEM privileges, as the win32k.sys driver runs in the kernel. The Duqu malware famously exploited this zero-day to gain a persistent, high-integrity foothold on target systems.
Platform: Windows Kernel
Version: XP SP3, 7 SP1
Vulnerability: Font Parsing
Severity: Critical
date: 2011-11-03
Prediction: 2011-12-13
What Undercode Say:
strings Duqu_malware.exe | grep -i ".ttf"
include <Windows.h>
int main() {
AddFontResourceA("malicious.ttf");
return 0;
}
How Exploit:
Malicious TTF in document.
User opens file.
Kernel pool overflow.
Arbitrary code execution.
Protection from this CVE
Apply MS11-087.
Disable WebClient service.
Use Microsoft EMET.
Impact:
Remote Code Execution.
System Compromise.
Kernel-Level Access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
