HTTP: Microsoft Windows TrueType Font Parsing Remote Code Execution (CVE-2011-3402)

This signature detects attempts to exploit a known vulnerability against Microsoft Windows TrueType Font. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft Windows kernel is prone to a remote code-execution vulnerability. An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially malformed TrueType font. Successful exploits can allow attackers to execute arbitrary code with kernel-level privileges. Failed exploit attempts may result in a denial-of-service condition.

Affected Products

Avaya messaging_application_server,Microsoft windows_xp

References

BugTraq: 50462

CVE: CVE-2011-3402

URL: http://technet.microsoft.com/en-us/security/advisory/2639658

Short Name

HTTP:STC:DL:TRUETYPE-PARSE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows TrueType Font Parsing Remote Code Execution (CVE-2011-3402)

Extended Description

Affected Products

References

Found a potential security threat?