Alert GCSA-10001 - MS10-001 Vulnerabilita' in Windows EOT Font Engine

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-10001
        Data : 13 gennaio 2010
      Titolo : MS10-001 Vulnerabilita' in Windows EOT Font Engine (972270)

******************************************************************


:: Descrizione del problema

    Microsoft ha rilasciato un aggiornamento per risolvere
    una vulnerabilita' presente nel Windows Embedded Open Type (EOT)
    font engine.


:: Software interessato

    Windows 2000 SP4
    Windows XP SP2 e SP3
    Windows XP Pro x64 Edition SP2
    Windows Server 2003 SP2
    Windows Server 2003 x64 Edition SP2
    Windows Server 2003 with SP2 for Itanium-based Systems
    Windows Vista
    Windows Vista SP1 e SP2
    Windows Vista x64 Edition
    Windows Vista x64 Edition SP1 e SP2
    Windows Server 2008 for 32-bit Systems
    Windows Server 2008 for 32-bit Systems SP2
      (Windows Server 2008 Server Core installation not affected)
    Windows Server 2008 for x64-based Systems
    Windows Server 2008 for x64-based Systems SP2
      (Windows Server 2008 Server Core installation not affected)
    Windows Server 2008 for Itanium-based Systems
    Windows Server 2008 for Itanium-based Systems SP2
    Windows 7 for 32-bit Systems
    Windows 7 for x64-based Systems
    Windows Server 2008 R2 for x64-based Systems
      (Windows Server 2008 R2 Server Core installation not affected)
    Windows Server 2008 R2 for Itanium-based Systems


:: Impatto

    Esecuzione remota di codice arbitrario
    Conquista del controllo sul sistema
    Crash delle applicazioni


:: Soluzioni

    Installare manualmente la patch elencata nel bollettino Microsoft,
    oppure utilizzare uno degli strumenti di aggiornamento come:
    Aggiornamenti Automatici, Windows Update, Microsoft Update,
    Windows Server Update Services.


:: Riferimenti

    Microsoft Security Bulletin
    http://www.microsoft.com/technet/security/Bulletin/MS10-001.mspx

    MS10-001: Font file decompression vulnerability
    http://blogs.technet.com/srd/archive/2010/01/12/ms10-001-font-file-decompression-vulnerability.aspx

    Microsoft Knowledge Base
    http://support.microsoft.com/kb/972270

    Microsoft Update
    https://update.microsoft.com/microsoftupdate/

    Mitre's CVE ID
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0018

    Vupen Security
    http://www.vupen.com/english/advisories/2010/0095

    ISC SANS
    http://isc.sans.org/diary.html?storyid=7954

    US-CERT Alert
    http://www.us-cert.gov/cas/techalerts/TA10-012B.html
    http://www.us-cert.gov/cas/alerts/SA10-012B.html


-----BEGIN PGP SIGNATURE-----

iQCVAwUBS03lV/OB+SpikaiRAQKStgQAk3TBksunmc4w15TUTUd3xDwK2T02xc+9
6NdCpIIXxCkODC4JtZOVCifRksy0yyLADPQdezkrBReGDtJWb3D2eKARuX9EcxGd
k41VkB2Xy8YEmmdUyzJoq0c5IJwkUss/fwWi6ssUlS7QtQKyWcUKuqpyRvGLi75X
EJeiQVZe7qA=
=57sN
-----END PGP SIGNATURE-----