PT-2011-1229 · Microsoft · Windows Xp+6

Published 2011-11-03 · Updated 2025-10-07 · CVE-2011-3402

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2, R2, and R2 SP1 Windows 7 Gold and SP1

Description The issue is related to errors in processing objects in memory in the TrueType font parsing engine in win32k.sys. Exploitation of this issue may allow a remote attacker to execute arbitrary code. This has been exploited in the wild, for example, by Duqu in November 2011. The vulnerability could be triggered by opening a specially crafted TrueType font file, potentially allowing an attacker to take complete control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows XP SP2 and SP3, consider applying security updates or patches to fix the vulnerability. For Windows Server 2003 SP2, apply the appropriate patch to resolve the issue. For Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1, update to a version that includes the fix for the TrueType font parsing vulnerability. As a temporary workaround, consider restricting the use of TrueType font files from untrusted sources until a patch is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2021-02842

CVE-2011-3402

Affected Products

Office

Windows

Windows 7

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/forensics/duqu_check.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-3402 · Security Note
• http://secunia.com/advisories/49121 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3402 · Security Note
• http://secunia.com/advisories/49122 · Vendor Advisory
• http://technet.microsoft.com/security/advisory/2639658 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02842 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998 · Note
• http://isc.sans.edu/diary/Duqu+Mitigation/11950 · Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 · Security Note, Vendor Advisory
• https://threats.kaspersky.com/ru/threat/Exploit.Win32.CVE-2011-3402.a · Note
• http://us-cert.gov/cas/techalerts/TA12-164A.html · Note
• https://t.me/purp_sec/1184 · Telegram Post