National Cyber Awareness System

Vulnerability Summary for CVE-2011-3402

Overview

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Security Bulletin: http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf

Name: http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf

Hyperlink:http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf

US-CERT Technical Alert: TA12-164A

Name: TA12-164A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA12-164A.html

US-CERT Technical Alert: TA12-129A

Name: TA12-129A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA12-129A.html

US-CERT Technical Alert: TA11-347A

Name: TA11-347A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA11-347A.html

External Source: MS

Name: MS12-034

Type: Advisory; Patch Information

Hyperlink:http://technet.microsoft.com/security/bulletin/MS12-034

External Source: MISC

Name: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

Hyperlink:http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

External Source: MISC

Name: http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit

Hyperlink:http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit

External Source: SECTRACK

Name: 1027039

Hyperlink:http://www.securitytracker.com/id?1027039

External Source: MISC

Name: http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two

Hyperlink:http://www.securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two

External Source: MS

Name: MS12-039

Hyperlink:http://technet.microsoft.com/security/bulletin/MS12-039

External Source: MS

Name: MS11-087

Hyperlink:http://technet.microsoft.com/security/bulletin/MS11-087

External Source: CONFIRM

Name: http://technet.microsoft.com/security/advisory/2639658

Type: Advisory

Hyperlink:http://technet.microsoft.com/security/advisory/2639658

External Source: SECUNIA

Name: 49122

Type: Advisory

Hyperlink:http://secunia.com/advisories/49122

External Source: SECUNIA

Name: 49121

Type: Advisory

Hyperlink:http://secunia.com/advisories/49121

External Source: OVAL

Name: oval:org.mitre.oval:def:15645

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:15645

External Source: OVAL

Name: oval:org.mitre.oval:def:15290

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:15290

External Source: OVAL

Name: oval:org.mitre.oval:def:13998

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13998

External Source: MISC

Name: http://isc.sans.edu/diary/Duqu+Mitigation/11950

Hyperlink:http://isc.sans.edu/diary/Duqu+Mitigation/11950

External Source: CONFIRM

Name: http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx

Hyperlink:http://blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx

External Source: MISC

Name: http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files

Hyperlink:http://blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files

References to Check Content

Identifier:oval:org.mitre.oval:def:13998

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:13998