Korean

<< Back VID 26472 Severity 40 Port 139,445 Protocol TCP Class SMB Detailed Description The Hotfix (MS09-065, 969947) for 'Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution' has not been applied. The most severe of the vulnerabilities could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font. In a Web-based attack scenario, an attacker would have to host a Web site that contains specially crafted embedded fonts that are used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince the user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the attacker's site. * Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts. * References: http://www.microsoft.com/technet/security/bulletin/MS09-065.mspx * Platforms Affected: Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 and SP2 Recommendation Apply the appropriate patch (969947)for your system, as listed in Microsoft Security Bulletin MS09-065 at http://www.microsoft.com/technet/security/Bulletin/MS09-065.mspx -- OR -- Patches for Windows platforms are also available from the Microsoft Windows Update Web site, http://windowsupdate.microsoft.com. Windows Update detects what version of Windows you are running and offers the appropriate patch. Related URL CVE-2009-2523 (CVE) Related URL 36921 (SecurityFocus) Related URL (ISS)