F-Secure
Tools
Windows Embedded OpenType Font Engine Two Vulnerabilities
| Report ID: | SA200903395 |
| Source: | Secunia |
| Date of Discovery: | 14.07.2009 |
| Criticality: | Urgent |
| Affects: | Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Professional Microsoft Windows 2000 Server Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2008 Microsoft Windows Storage Server 2003 Microsoft Windows Vista Microsoft Windows XP Home Edition Microsoft Windows XP Professional |
| Compromise From: | From remote |
| Compromise Type: | System access |
Summary
Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to compromise a user's system.
Detailed Description
1) An integer truncation error in the Embedded OpenType (EOT) Font Engine component when parsing data records in embedded fonts can be exploited to cause a heap-based buffer overflow via a specially crafted embedded font.
2) An integer overflow error in the Embedded OpenType (EOT) Font Engine component when parsing name tables in embedded fonts can be exploited to corrupt memory via a specially crafted embedded font.
Successful exploitation of the vulnerabilities allows execution of arbitrary code when a user e.g. visits a malicious web page.
2) An integer overflow error in the Embedded OpenType (EOT) Font Engine component when parsing name tables in embedded fonts can be exploited to corrupt memory via a specially crafted embedded font.
Successful exploitation of the vulnerabilities allows execution of arbitrary code when a user e.g. visits a malicious web page.
Solution
Apply patches.
NOTE: On 2009-08-11 the vendor has re-released patches for Windows 2000, Windows XP, and Windows Server 2003 in order to fix a problem with the original updates.
Windows 2000 SP4:
http://www.microsoft.com/downloads/details.aspx?familyid=1efbbd95-cd72-43df-b1ce-7e2b0c0cb9e2
Windows XP SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=6914167b-6961-480c-a4d4-808cd58a035b
Windows XP SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=6914167b-6961-480c-a4d4-808cd58a035b
Windows XP Professional x64 Edition SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=3b8b019e-e6d8-4ce2-8f1f-3a6399b252d1
Windows Server 2003 SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=018ef53d-f78e-4084-940d-7c86bf59d83c
Windows Server 2003 x64 Edition SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=7f5fc902-f5d8-4a87-a73f-68632f9a0935
Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=7df0fce2-543c-4e82-85e6-012bfc8bf130
Windows Vista (optionally with SP1/SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=c67d85c4-25c5-4821-8db9-91764888f893
Windows Vista x64 Edition (optionally with SP1/SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=3f8ae651-59f7-48e1-9e8c-8e07c6806964
Windows Server 2008 for 32-bit Systems (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=91f6ee68-0e39-4ec3-b4cd-45f05404e2fb
Windows Server 2008 for x64-based Systems (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=5cdc3014-97b3-47b5-a6b7-cd0e12ec60e4
Windows Server 2008 for Itanium-based Systems (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=03330a14-9cfa-4146-a3d3-4b7a76975d2d
NOTE: On 2009-08-11 the vendor has re-released patches for Windows 2000, Windows XP, and Windows Server 2003 in order to fix a problem with the original updates.
Windows 2000 SP4:
http://www.microsoft.com/downloads/details.aspx?familyid=1efbbd95-cd72-43df-b1ce-7e2b0c0cb9e2
Windows XP SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=6914167b-6961-480c-a4d4-808cd58a035b
Windows XP SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=6914167b-6961-480c-a4d4-808cd58a035b
Windows XP Professional x64 Edition SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=3b8b019e-e6d8-4ce2-8f1f-3a6399b252d1
Windows Server 2003 SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=018ef53d-f78e-4084-940d-7c86bf59d83c
Windows Server 2003 x64 Edition SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=7f5fc902-f5d8-4a87-a73f-68632f9a0935
Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=7df0fce2-543c-4e82-85e6-012bfc8bf130
Windows Vista (optionally with SP1/SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=c67d85c4-25c5-4821-8db9-91764888f893
Windows Vista x64 Edition (optionally with SP1/SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=3f8ae651-59f7-48e1-9e8c-8e07c6806964
Windows Server 2008 for 32-bit Systems (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=91f6ee68-0e39-4ec3-b4cd-45f05404e2fb
Windows Server 2008 for x64-based Systems (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=5cdc3014-97b3-47b5-a6b7-cd0e12ec60e4
Windows Server 2008 for Itanium-based Systems (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=03330a14-9cfa-4146-a3d3-4b7a76975d2d