Type Vulnerability
An attacker could exploit the vulnerability by constructing a specially crafted Web page. Known-exploited catalogue reports exploitation in the wild.
Microsoft · Code execution
Microsoft Windows Remote Code Execution Vulnerability
CVE-2011-3402
What this means
This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Microsoft Windows 7, Microsoft Windows Server 2003 and Microsoft Windows Server 2008, and 2 more are in your estate, and treat that as the priority.
Full vendor description
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Scoring and exploitation
8.8/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~78.1% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Microsoft Windows
Weaknesses
NVD-CWE-noinfo
Affected products ()
- Microsoft Windows 7
- Microsoft Windows Server 2003
- Microsoft Windows Server 2008
- Microsoft Windows Vista
- Microsoft Windows Xp
Show the raw CPE strings (9)
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
References
20 links from the CVE record, grouped by site; the vendor's advisory comes first.
blogs.technet.com1 linkVendor advisory
secunia.com2 linksVendor advisory
- 49121 (opens in a new tab)Vendor Advisory
- 49122 (opens in a new tab)Vendor Advisory
technet.microsoft.com1 linkVendor advisory
- 2639658 (opens in a new tab)Vendor Advisory
docs.microsoft.com3 linksVendor advisory
- ms11-087 (opens in a new tab)Vendor Advisory
- ms12-034 (opens in a new tab)Vendor Advisory
- ms12-039 (opens in a new tab)Vendor Advisory
blogs.mcafee.com1 link
isc.sans.edu1 link
- 11950 (opens in a new tab)Third Party Advisory
securelist.com1 link
- The_Mystery_of_Duqu_Part_Two (opens in a new tab)Not Applicable
securitytracker.com1 link
- id (opens in a new tab)Broken Link
symantec.com2 links
us-cert.gov4 links
- TA11-347A.html (opens in a new tab)US Government Resource
- TA12-129A.html (opens in a new tab)US Government Resource
- TA12-164A.html (opens in a new tab)US Government Resource
Show 1 more from us-cert.gov
- ICS-ALERT-11-291-01E.pdf (opens in a new tab)US Government Resource
oval.cisecurity.org3 links