Important! Please Do This Today. Microsoft Issues Fix for Duqu Zero Day True Type Vulnerability

Published on November 5, 2011 By DrJBHL In Personal Computing

A real quicky for you folks.

Microsoft has issued a fix to prevent exploitation of the True Type vulnerability which allows exploitation of the Win x32 true type font parsing engine (the Duqu Trojan/virus rootkit).

An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The fix is for x486 and x64 systems. It’s a “work around”, but it works and is strongly recommended until MS issues a “patch”

Just so you know, the vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message.

Patch Tuesday is coming up, by the way. Four updates are expected this time.

The fix can be obtained here: http://support.microsoft.com/kb/2639658

Important Update:

This temporary fix prevents sfc /scannow. It will abort at 28% (mine did). The "Disable" (see above) re-enables sfc /scannow.

Comments

Philly0381

on Nov 05, 2011

Okay I did it, and it was easy enough to do.

Question, what would have been the risk of waiting for Patch Tuesday?

I don't ever open an attachment that comes in an email unless I'm expecting it.

Starcandy

on Nov 05, 2011

Done and done. Cheers, Doc!

DrJBHL

on Nov 05, 2011

Philly0381

reply 1

Question, what would have been the risk of waiting for Patch Tuesday?

How can I answer that?

Important enough for MS to have released it early.

Because they did, I notified.

pacov

on Nov 05, 2011

Thx, doc. I installed it. Doesn't look like a problem that would impact any of us techies, though, but thanks all the same.

kryo

on Nov 05, 2011

Question, what would have been the risk of waiting for Patch Tuesday?

Just so you know, the vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message.

Zero, if you don't open unsolicited attachments. It was released early simply because most users don't think before clicking.

Savyg

on Nov 05, 2011

People open email attachments? Weird.

DrJBHL

on Nov 06, 2011

kryo

reply 5

Question, what would have been the risk of waiting for Patch Tuesday?

Just so you know, the vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must open an attachment that is sent in an e-mail message.

Zero, if you don't open unsolicited attachments. It was released early simply because most users don't think before clicking.

Might come in an attachment from someone you know/trust.... spear phishing. Unfortunately, no one is invulnerable.

Of course one shouldn't open an attachment from an unknown source and delete the email immediately

Savyg

on Nov 06, 2011

DrJBHL

reply 7

Might come in an attachment from someone you know/trust.... spear phishing. Unfortunately, no one is invulnerable.

Of course one shouldn't open an attachment from an unknown source and delete the email immediately

I rather disagree. Intelligence is the best armor there is.

DrJBHL

on Nov 06, 2011

If someone you know, or a superior at work sends you an email with an attachment, why would you suspect anything? It would not ne logical not to open the email and document. This fix prevents a Doqu infected document from infecting your computer.

pacov

on Nov 06, 2011

DrJBHL

reply 9

If someone you know, or a superior at work sends you an email with an attachment, why would you suspect anything?

Because frankly, everyone I know and some of the folks I work with are not quite as tech savy as me. I would suspect something. Just sayin'. But still, good work for the heads up. I certainly always prefer to be informed. Thanks!

Nimbin

on Nov 06, 2011

I won't even open an attachment from my own mother. People who know me, know well enough to never send me any emails with attachments unless they tell me beforehand. Trust no one....... ever, that's the catch call i have lived by for many years and it has never failed me.

Dr Guy

on Nov 08, 2011

Thanks for the heads up!

Savyg

on Nov 09, 2011

DrJBHL

reply 9

Why would I suspect anything, you ask?

Because they sent me an attachment.

ElanaAhova

on Nov 10, 2011

Thanks Doc, you are the best.....

Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:

Richer content, access to many features that are disabled for guests like commenting on the forums.
Access to a great community, with a massive database of many, many areas of interest.
Access to contests & subscription offers like exclusive emails.
It's simple, and FREE!