CVE-2011-3402: Microsoft Windows Remote Code Execution Vulnerability
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
Other sources
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Follow applicable BOD 22-01 guidance for cloud services.
- Compensating control
Discontinue use of the product if mitigations are unavailable: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1.
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3402?
CVE-2011-3402 is considered critical as it allows remote attackers to execute arbitrary code on vulnerable systems.
Which operating systems are affected by CVE-2011-3402?
CVE-2011-3402 affects Microsoft Windows Vista, Windows XP, Windows 7, and Windows Server 2008 and 2003.
How do I fix CVE-2011-3402?
To mitigate CVE-2011-3402, ensure that your operating system is updated with the latest security patches provided by Microsoft.
Can CVE-2011-3402 be exploited through email?
Yes, CVE-2011-3402 can be exploited through crafted font data embedded in Word documents or malicious web pages.
What kind of attacks are possible due to CVE-2011-3402?
CVE-2011-3402 can allow attackers to execute arbitrary code, potentially compromising the entire system.