CVE-2015-2463 : Detail

CVE-2015-2463

A03-Injection
8.63%V3
Network
2015-08-14
22h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2464.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 37915

Publication date : 2015-08-20 22h00 +00:00
Author : Google Security Research
EDB Verified : Yes

Source: https://code.google.com/p/google-security-research/issues/detail?id=401&can=1 We have encountered a Windows kernel crash in the win32k!fsc_RemoveDups function while processing corrupted TTF font files, such as: --- PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ff6e7000, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: 91e809df, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from 8277c84c Unable to read MiSystemVaType memory at 8275bf00 ff6e7000 FAULTING_IP: win32k!fsc_RemoveDups+85 91e809df 3918 cmp dword ptr [eax],ebx MM_INTERNAL_CODE: 0 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: csrss.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 91e8015c to 91e809df STACK_TEXT: 969e3624 91e8015c 969e3858 fbff0e78 0000002b win32k!fsc_RemoveDups+0x85 969e36cc 91e89979 ff6de010 ff6de07c 00000001 win32k!fs_FindBitMapSize+0x2de 969e36e8 91e89b59 fbff0e78 0000002b 00000001 win32k!bGetGlyphMetrics+0x39 969e382c 91e7ec63 fbff0e78 0000002b 969e3918 win32k!lGetGlyphBitmap+0x2b 969e3850 91e7eab6 00000000 00000001 0000002b win32k!ttfdQueryFontData+0x158 969e38a0 91e7dce2 ff7af010 fbe0ccf0 00000001 win32k!ttfdSemQueryFontData+0x45 969e38e8 91e83774 ff7af010 fbe0ccf0 00000001 win32k!PDEVOBJ::QueryFontData+0x3e 969e3960 91efbc8d 969e3c3c fbe2cc94 ff713154 win32k!xInsertMetricsPlusRFONTOBJ+0x120 969e3990 91e7594d 0000000a ff7bf000 969e3cd0 win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x179 969e39c8 91efb78b 969e3c1c 969e3c3c 00000008 win32k!ESTROBJ::vCharPos_H3+0xf0 969e3a0c 91e755d0 969e3cd0 0000000a 969e3c1c win32k!ESTROBJ::vInit+0x268 969e3c2c 91e75793 00000000 969e3cd0 fbe0ccf0 win32k!GreGetTextExtentExW+0x12a 969e3d0c 8264f896 0701015e 02bb0bac 0000000a win32k!NtGdiGetTextExtentExW+0x141 969e3d0c 779670f4 0701015e 02bb0bac 0000000a nt!KiSystemServicePostCall WARNING: Frame IP not in any known module. Following frames may be wrong. 0015f434 00000000 00000000 00000000 00000000 0x779670f4 --- While we have not determined the specific root cause of the vulnerability, we have pinpointed the offending mutations to reside in the "glyf" table. The issue reproduces on Windows 7 and 8.1. It is easiest to reproduce with Special Pools enabled for win32k.sys (leading to an immediate crash when the bug is triggered), but it is also possible to observe a crash on a default Windows installation in win32k!fsc_RemoveDups or another location in kernel space. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays all of the font's glyphs at various point sizes. Attached is a proof of concept font file together with the corresponding kernel crash log. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37915.zip

Products Mentioned

Configuraton 0

Microsoft>>.net_framework >> Version 3.0

Microsoft>>.net_framework >> Version 4.0

Microsoft>>.net_framework >> Version 4.5

Microsoft>>.net_framework >> Version 4.5.1

Microsoft>>.net_framework >> Version 4.5.2

Microsoft>>.net_framework >> Version 4.6

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_vista >> Version -

Configuraton 0

Microsoft>>.net_framework >> Version 3.5.1

Microsoft>>Windows_7 >> Version -

Microsoft>>Windows_server_2008 >> Version r2

Configuraton 0

Microsoft>>.net_framework >> Version 3.5

Microsoft>>Windows_8 >> Version -

Microsoft>>Windows_8.1 >> Version -

Microsoft>>Windows_server_2012 >> Version *

Microsoft>>Windows_server_2012 >> Version r2

Configuraton 0

Microsoft>>Live_meeting >> Version 2007

Microsoft>>Lync >> Version 2010

Microsoft>>Lync >> Version 2010

Microsoft>>Lync >> Version 2013

Microsoft>>Lync_basic >> Version 2013

    Microsoft>>Office >> Version 2007

    Microsoft>>Office >> Version 2010

    Microsoft>>Silverlight >> Version To (including) 5.1.40416.0

    Configuraton 0

    Microsoft>>Windows_7 >> Version -

    Microsoft>>Windows_8 >> Version -

    Microsoft>>Windows_8.1 >> Version -

    Microsoft>>Windows_rt >> Version -

    Microsoft>>Windows_rt_8.1 >> Version -

    Microsoft>>Windows_server_2008 >> Version -

    Microsoft>>Windows_server_2008 >> Version r2

    Microsoft>>Windows_server_2008 >> Version r2

    Microsoft>>Windows_server_2012 >> Version -

    Microsoft>>Windows_server_2012 >> Version r2

    Microsoft>>Windows_vista >> Version -

    References

    http://www.securitytracker.com/id/1033238
    Tags : vdb-entry, x_refsource_SECTRACK
    http://www.securityfocus.com/bid/76239
    Tags : vdb-entry, x_refsource_BID
    https://www.exploit-db.com/exploits/37915/
    Tags : exploit, x_refsource_EXPLOIT-DB