Vulnerabilitymedium
The Mystery of Duqu: Part Five
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2011-3402 | Remote Code Execution in Microsoft Windows Kernel TrueType Font Parser (win32k.sys) | — | 78% | KEV | — KEV |
From the original article
5 min read at securelist.com
The driver is the first component of Duqu to be loaded in the system. As we discovered, the driver and other components of malware are installed with a dropper exploiting a 0-day vulnerability (CVE-2011-3402). The driver is registered in the HKLMSystemCurrentControlSetServices registry path.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.