HTTP: Microsoft Windows Embedded OpenType Font Engine LZCOMP Integer Overflow

This signature detects attempts to exploit a known vulnerability in Microsoft Windows. An integer overflow flaw exists in Microsoft Windows Embedded OpenType (EOT) Font Engine. It is due to insufficient validation of an integer value by the font decompression code in the EOT Font Engine. An attacker can create a malicious Web page utilizing Cascading Style Sheets (CSS) that specify a malicious Embedded OpenType (EOT) font file and entices a victim to view the page. A successful attack can allow remote code execution with the privileges of the user.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that affects the Embedded OpenType font engine. An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Successful exploits may aid in the compromise of affected computers. Failed attempts may trigger a denial-of-service condition.

Affected Products

Avaya messaging_application_server,Microsoft windows_server_2008_for_itanium-based_systems

References

BugTraq: 37671

CVE: CVE-2010-0018

Short Name

HTTP:STC:IE:EOTF-LZCOMP-OF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Embedded OpenType Font Engine LZCOMP Integer Overflow

Extended Description

Affected Products

References

Found a potential security threat?