Check Point Advisories

Microsoft Embedded OpenType EOT Font Integer Overflow (MS10-076; CVE-2010-1883)

Vulnerability
Protection

Check Point Reference:	CPAI-2012-043
Date Published:	14 Feb 2012
Severity:	Medium
Last Updated:	Tuesday 14 February, 2012
Source:
Industry Reference:	CVE-2010-1883
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an integer overflow in the Microsoft Windows EOT component, when parsing certain tables within specially crafted files and content containing embedded fonts. A remote attacker may exploit this issue by creating a file that contains a specially crafted EOT font embedded in the document and convincing a user to open or preview the file. Successful exploitation of this issue allows execution of arbitrary code once the malformed file is being opened or previewed on an affected system.

Protection Overview

This protection will detect and block the transferring of malformed EOT files over HTTP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Microsoft Embedded OpenType EOT Font Integer Overflow (MS10-076) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Content Protection Violation.
Attack Information: Microsoft Embedded OpenType EOT font integer overflow (MS10-076)