PT-2010-1843 · Microsoft · Windows Vista+7

Tavis Ormandy · Published 2010-01-13 · Updated 2023-12-07 · CVE-2010-0018

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2

Description The issue is related to an integer overflow in the Embedded OpenType (EOT) Font Engine, which allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font. This vulnerability can be exploited to take complete control of an affected system, enabling actions such as installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights. The impact may be less severe for users with fewer user rights on the system compared to those operating with administrative user rights.

Recommendations For Windows 2000 SP4, consider applying the relevant security update to address the issue. For Windows XP SP2 and SP3, apply the security update to resolve the vulnerability. For Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, ensure that the latest security patches are installed to mitigate the risk. As a temporary workaround, consider restricting the use of the Embedded OpenType (EOT) Font Engine until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-0018

Affected Products

Embedded Opentype (Eot) Font Engine

Windows

Windows 2000

Windows 7

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2010-0018 · Security Note
• http://secunia.com/advisories/35457 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-001 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0095 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0018 · Security Note
• http://securityfocus.com/bid/37671 · Note
• http://osvdb.org/61651 · Note
• http://us-cert.gov/cas/techalerts/TA10-012B.html · Note
• http://securitytracker.com/id?1023432 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8324 · Note
• http://blogs.technet.com/srd/archive/2010/01/12/ms10-001-font-file-decompression-vulnerability.aspx · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/ms10-001 · Note