Cloudanix VulnDB

CVE-2017-0089

High · 8.8

CVSS

8.8

EPSS

57.3%

Published

Mar 17, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

Older Windows systems contain a flaw that lets hackers take over a computer simply by tricking someone into visiting a malicious webpage.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Memory corruption in the Uniscribe font and text rendering engine allows arbitrary code execution when processing specially crafted content delivered via a web page.

Why it matters to the business

Attackers can remotely compromise legacy Windows systems, resulting in full system takeover, data theft, or malware deployment on any remaining Vista, Server 2008, or Windows 7 deployments that have not been replaced.

How an attack unfolds

An attacker crafts a web page containing malicious font or text data and hosts it on a site visited by the victim. When the browser's Uniscribe component processes the content, memory corruption is triggered, allowing the attacker to execute arbitrary code in the context of the logged-on user.

How to fix it

Migrate away from unsupported Windows Vista, Server 2008, and Windows 7 systems. On any remaining supported configurations, ensure all available cumulative updates are applied through Windows Update or WSUS. Enforce web content filtering and browser sandboxing as compensating controls.

How to confirm the fix worked

Confirm absence of the vulnerable Uniscribe DLL versions through system file checks or update history review. Perform controlled rendering tests of complex text and monitor usp10.dll for crashes or unexpected behavior.

Typical attack path

  1. Craft malicious webpage with specially formatted font or text data
  2. Host the page on an attacker-controlled web server
  3. Lure the victim to visit the page via phishing or compromised sites
  4. Victim's browser renders the page and invokes Uniscribe
  5. Memory corruption leads to arbitrary code execution

How to detect it

Review web proxy and browser process logs for visits to suspicious domains followed by unexpected usp10.dll activity or crashes. Correlate with endpoint telemetry showing new processes spawned from browser contexts after web browsing.

What your security team should do

  • Accelerate decommissioning of end-of-life Windows versions
  • Block or heavily restrict access to untrusted web content for any legacy hosts
  • Enable enhanced logging of browser and font-rendering processes
  • Test application compatibility on modern Windows platforms

The record

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Uniscribe Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, and CVE-2017-0090.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities