PT-2013-4729 · Microsoft · Windows+3

Ling Chuan Lee · Published 2013-12-10 · Updated 2019-05-08 · CVE-2013-3903

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows 8 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1

Description A denial of service issue exists in the Microsoft Windows kernel, caused by improper processing of a specifically crafted TrueType font (TTF) file. This can allow local users to cause a denial of service, resulting in the system stopping to respond and restarting.

Recommendations For Windows 8, update to a version that includes the fix for the TrueType Font Parsing issue. For Windows Server 2012 Gold and R2, apply the necessary patch to resolve the kernel-mode driver issue. For Windows RT Gold and 8.1, ensure that all security updates are applied to prevent exploitation of the vulnerability. As a temporary workaround, consider restricting the use of TrueType font files until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-3903

Affected Products

Windows

Windows 8

Windows Rt

Windows Server 2012

References · 4

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3903 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3903 · Security Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-101 · Note