Homepage
Forum
Drivers
HMM
MTM
Feed
Microsoft Security Bulletin MS06-002
Vulnerability in Embedded Web Fonts Could Allow Remote Code Execution (908519)
This update resolves a newly-discovered, privately-reported vulnerability.
An attacker who successfully exploited this vulnerability could take control of an affected system. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
We recommend that customers apply the update immediately. (*emphasis added*)
The fix is available at Windows Update. If you don't have Automatic Updates configured in Windows 2000/XP to download updates, or even just alert you, you might reconsider.FAQ for Windows Embedded Web Font Vulnerability - CVE-2006-0010:
What is the scope of the vulnerability?
If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
What causes the vulnerability?
When Windows displays a specially formed embedded Web font, it may corrupt system memory in such a way that an attacker could execute arbitrary code.
What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could take complete control of the affected system.
How could an attacker exploit the vulnerability?
An attacker could exploit this vulnerability by creating a malicious Web page or an HTML e-mail message and then persuading the user to visit the page or to view the HTML e-mail message. If the user visited the page or viewed the e-mail message, the attacker could access information from other Web sites, could access local files in predetermined locations on the system, or could cause malicious code to run in the security context of the locally logged on user. An attacker could also try to compromise a Web site and have it display malicious content. Additionally, it could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems.
What systems are primarily at risk from the vulnerability?
This vulnerability requires that a user is logged on and reading e-mail or visiting Web sites for any malicious action to occur. Therefore, any systems where e-mail is read or where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability. Systems that are not typically used to read e-mail or to visit Web sites, such as most server systems, are at a reduced risk....
