Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege
Friday, November 11, 2011 at 12:31PM Microsoft Security Advisory (2639658)
Updated: Tuesday, November 08, 2011
General Information
Executive Summary
Microsoft is investigating a vulnerability in a Microsoft Windows component, the Win32k TrueType font parsing engine. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. We are aware of targeted attacks that try to use the reported vulnerability; overall, we see low customer impact at this time. This vulnerability is related to the Duqu malware.
Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. For information about protections released by MAPP partners, see MAPP Partners with Updated Protections.
Paul Thurrott has his on take on this posted Nov 8th 2011
Reader Comments (1)
This is alarming! Good thing Microsoft is doing something to stop this.