Actu
Vigil@nce: Windows, denial of service via DirectWrite
March 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
When an application is compiled with DirectWrite, an attacker can
use a special sequence of Unicode characters, in order to stop the
application.
– Severity: 1/4
– Creation date: 13/03/2012
IMPACTED PRODUCTS
– Microsoft Windows 2008
– Microsoft Windows 7
– Microsoft Windows Vista
DESCRIPTION OF THE VULNERABILITY
The DirectWrite feature is used to develop applications supporting
complex character fonts. Products such as Windows Live Messenger
are compiled with DirectWrite.
However, a special sequence of Unicode character generates an
error in DirectWrite, which blocks or stops the application.
When an application is compiled with DirectWrite, an attacker can
therefore use a special sequence of Unicode characters, in order
to stop the application. For example, an attacker can send a
malicious message to a user of Windows Live Messenger, in order to
block it.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Windows-denial-of-service-via-DirectWrite-11435
