Advisory Details

October 11th, 2013

Microsoft Windows OpenType Font Parsing Persistent Denial-of-Service Vulnerability

CVE ID	CVE-2013-3128
CVSS SCORE	7.1, AV:N/AC:M/Au:N/C:N/I:N/A:C
AFFECTED VENDORS	Microsoft
AFFECTED PRODUCTS	Windows XP SP3
TREND MICRO CUSTOMER PROTECTION	Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['13235']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS	This vulnerability allows remote attackers to causes a persistent Denial-of-Service on machines running vulnerable versions of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must open a vulnerable font. The specific flaw exists within the handling of OpenType Fonts in the Windows Kernel. The machine will immediately crash and be unable to restart if a user attempts to use the malicious font.
ADDITIONAL DETAILS	Microsoft has issued an update to correct this vulnerability. More details can be found at: https://technet.microsoft.com/en-us/security/bulletin/ms13-081
DISCLOSURE TIMELINE	2013-02-22 - Vulnerability reported to vendor 2013-10-11 - Coordinated public release of advisory
CREDIT	Anonymous

BACK TO ADVISORIES