=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2011/VULN094
_____________________________________________________________________

DATE                      : 09/02/2011

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Windows XP, Windows Server 2003,
                             Windows Vista, Windows Server 2008, Windows 7.

======================================================================
KB2485376
http://www.microsoft.com/technet/security/bulletin/MS11-007.mspx
______________________________________________________________________

Microsoft Security Bulletin MS11-007 - Critical
Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow
Remote Code Execution (2485376)

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in the Windows
OpenType Compact Font Format (CFF) driver. The vulnerability could allow remote
code execution if a user views content rendered in a specially crafted CFF
font. In all cases, an attacker would have no way to force users to view the
specially crafted content. Instead, an attacker would have to convince users
to visit a Web site, typically by getting them to click a link in an e-mail
message or Instant Messenger message that takes users to the attacker's Web
site.

This security update is rated Critical for all supported editions of Windows
Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. This
security update is also rated Important for all supported editions of Windows
XP and Windows Server 2003. For more information, see the subsection, Affected
and Non-Affected Software, in this section.

The security update addresses the vulnerability by correcting the manner in
which the Windows OpenType Compact Font Format (CFF) driver validates the
parameter values of specially crafted OpenType fonts. For more information
about the vulnerability, see the Frequently Asked Questions (FAQ) subsection
for the specific vulnerability entry under the next section, Vulnerability
Information.

Affected Software

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service
  Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit
  Systems Service Pack 2*
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based
  Systems Service Pack 2*
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for
  Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems*
Windows Server 2008 R2 for Itanium-based Systems

Vulnerability Information

OpenType Font Encoded Character Vulnerability - CVE-2011-0033

A remote code execution vulnerability exists in the way that the Windows
OpenType Compact Font Format (CFF) driver improperly parses specially crafted
OpenType fonts. An attacker who successfully exploited this vulnerability
could run arbitrary code in kernel mode. An attacker could then install
programs; view, change, or delete data; or create new accounts with full user
rights.


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================