Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MS06-002 | First vendor Publication | N/A |
| Vendor | Microsoft | Last vendor Modification | N/A |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Vulnerability in Embedded Web Fonts Could Allow Remote Code Execution (908519) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1126 | |||
| Oval ID: | oval:org.mitre.oval:def:1126 | ||
| Title: | Server 2003 Embedded Web Font Vulnerability | ||
| Description: | Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-0010 | Version: | 6 |
| Platform(s): | Microsoft Windows Server 2003 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1185 | |||
| Oval ID: | oval:org.mitre.oval:def:1185 | ||
| Title: | Server 2003,SP1 Embedded Web Font Vulnerability | ||
| Description: | Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-0010 | Version: | 5 |
| Platform(s): | Microsoft Windows Server 2003 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1462 | |||
| Oval ID: | oval:org.mitre.oval:def:1462 | ||
| Title: | WinXP (64-bit) Embedded Web Font Vulnerability | ||
| Description: | Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-0010 | Version: | 5 |
| Platform(s): | Microsoft Windows XP | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1491 | |||
| Oval ID: | oval:org.mitre.oval:def:1491 | ||
| Title: | WinXP,SP1 Embedded Web Font Vulnerability | ||
| Description: | Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-0010 | Version: | 5 |
| Platform(s): | Microsoft Windows XP | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:698 | |||
| Oval ID: | oval:org.mitre.oval:def:698 | ||
| Title: | WinXP,SP2 Embedded Web Font Vulnerability | ||
| Description: | Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-0010 | Version: | 6 |
| Platform(s): | Microsoft Windows XP | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:714 | |||
| Oval ID: | oval:org.mitre.oval:def:714 | ||
| Title: | Win2k Embedded Web Font Vulnerability | ||
| Description: | Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2006-0010 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 18829 | Microsoft Windows Open Type (EOT) Font Handling Remote Overflow A remote overflow exists in Microsoft Windows. Many versions fail to perform correct boundary checks in web requests involving embedded fonts, resulting in a heap overflow. With a specially crafted web font, an attacker can cause arbitrary code execution, resulting in a loss of integrity. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows embedded web font handling buffer overflow attempt RuleID : 17626 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows embedded web font handling buffer overflow attempt RuleID : 16089 - Revision : 13 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-01-10 | Name : Arbitrary code can be executed on the remote host by sending a malformed file... File : smb_nt_ms06-002.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:45:18 |
|
