Microsoft Windows Kernel TrueType Font Parsing CVE-2014-6317 Denial of Service Vulnerability

Bugtraq ID:	70949
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-6317
Remote:	Yes
Local:	No
Published:	Nov 11 2014 12:00AM
Updated:	Nov 11 2014 12:00AM
Credit:	Secunia Research
Vulnerable:	Microsoft Windows Vista x64 Edition SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1
Not Vulnerable:

Microsoft Windows Kernel TrueType Font Parsing CVE-2014-6317 Denial of Service Vulnerability

Microsoft Windows is prone to a remote denial-of-service vulnerability that occurs in the Windows kernel.

A remote attacker can exploit this issue to crash the Windows kernel, denying service to legitimate users.

Microsoft Windows Kernel TrueType Font Parsing CVE-2014-6317 Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Kernel TrueType Font Parsing CVE-2014-6317 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Windows Server 2003 Itanium SP2

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=662311df-14e6 -4168-9f4e-f3f68e0dcbee

Microsoft Windows Vista SP2

• Microsoft Security Update for Windows Vista (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=c829eb78-eb2f -4ae8-97d8-1a2d25ec52a6

Microsoft Windows 8 for 32-bit Systems 0

• Microsoft Security Update for Windows 8 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=286973ee-c99d -4e26-8d4f-e4396275894a

Microsoft Windows 7 for 32-bit Systems SP1

• Microsoft Security Update for Windows 7 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=760b929a-378f -4f1c-8da6-208b4b4eb813

Microsoft Windows Server 2008 R2 for x64-based Systems SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=39e0602a-1026 -4a5f-9342-0ac775fa6f0a

Microsoft Windows 7 for x64-based Systems SP1

• Microsoft Security Update for Windows 7 for x64-based Systems (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=a448b00f-a5ea -4d00-8474-8887dec05239

Microsoft Windows Server 2008 for Itanium-based Systems SP2

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=18c52931-24cd -4a5d-8498-85b213cc9db8

Microsoft Windows Server 2012 0

• Microsoft Security Update for Windows Server 2012 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=750a2329-9c64 -4305-872b-bc8cb13887a7

Microsoft Windows Server 2008 for 32-bit Systems SP2

• Microsoft Security Update for Windows Server 2008 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=7f96e1c2-0426 -44f1-9795-d3ea544c49bc

Microsoft Windows Vista x64 Edition SP2

• Microsoft Security Update for Windows Vista for x64-based Systems (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=24e91406-aad0 -4c3c-9968-21da926c769a

Microsoft Windows Server 2012 R2 0

• Microsoft Security Update for Windows Server 2012 R2 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=f3680bcf-b91d -4f21-85a0-a4449a195da9

Microsoft Windows Server 2003 SP2

• Microsoft Security Update for Windows Server 2003 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=b0f0d9d2-8cfd -485e-adc9-a8c2ae7ed53b

Microsoft Windows 8.1 for 32-bit Systems 0

• Microsoft Security Update for Windows 8.1 (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=a29f292a-e80b -47ee-88aa-02c86b13cd5f

Microsoft Windows Server 2003 x64 SP2

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=f5465485-9cb1 -4fa7-abb2-d1fd22cf010e

Microsoft Windows 8 for 64-bit Systems 0

• Microsoft Security Update for Windows 8 for x64-based Systems (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=20189d32-a5e8 -4bfc-a3a7-34a0c933f8a4

Microsoft Windows Server 2008 for x64-based Systems SP2

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB3002885)
  http://www.microsoft.com/downloads/details.aspx?familyid=3f16aa1b-f4c5 -49c3-b6d6-8dc567584969

Microsoft Windows Kernel TrueType Font Parsing CVE-2014-6317 Denial of Service Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS14-079 (Microsoft)