Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Vulnerability protection

Windows kernel-mode drivers vulnerabilities could allow remote code execution


Report ID: MS201307002
Date Published: 11 July 2013

Criticality: Critical
Compromise Type: remote-code-execution privilege-escalation information-disclosure denial-of-service
Compromise From: remote


Affected Product/Component:

Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 8
Windows Server 2012
Windows RT




Summary

Eight vulnerabilities were reported in the Windows kernel-mode drivers, which could lead to various situations that include remote code execution, escalation of privilege, information disclosure and denial of service.



Detailed Description

Microsoft has issued a security update to resolve eight reported vulnerabilities in the Windows kernel-mode drivers, seven of which were caused by improper handling of objects in memory and one was caused by improper handling of TrueType Fonts (TTF) files. Upon successful exploitation, an attacker could be able to execute arbitrary code, gain escalated privilege, view sensitive information and cause the system to stop responding.

All of these issues have been resolved in the update by correcting the way that Windows handles objects in memory and specially crafted TrueType Fonts (TTF) files. Users are recommended to install the updates to protect their system from possible exploit attempts.



CVE Reference

CVE-2013-1300,CVE-2013-1340, CVE-2013-1345, CVE-2013-3129, CVE-2013-3167, CVE-2013-3172, CVE-2013-3173, CVE-2013-3660



Solution

Install the latest security patch for applicable system, available for download from (https://technet.microsoft.com/en-us/security/bulletin/ms13-053)




Security Advisories

For a list of known vulnerabilities affecting F-Secure products and the released fixes, please refer to the Security Advisories page.