Duqu Workaround Causing Graphics Driver Error

A workaround released by Microsoft to block a vulnerability that could lead to the Duqu worm installing itself is causing issues with graphics driver managing font displays.

The company said it is investigating the vulnerability, originally reported by Symantec and researchers in Budapest, and that a more permanent patch might be issued in the future. In the meantime, applications relying on embedded font technology could fail to display properly when using the workaround.

Duqu has gained attention because it appears to include source code from the Stuxnet worm, a sophisticated cyber weapon believed to have successfully attacked and damaged uranium refining equipment in Iran. Researchers from Symantec Security Response confirmed that Duqu is nearly identical to Stuxnet but initially were not able to determine how the malware installed itself.

The installer was recovered by the Laboratory of Cryptography and System Security at the Budapest University of Technology and Economics and analyzed by Symantec. The exploit in at least one case was delivered with the installer file in a Microsoft Word document attachment that had targeted the recipient.

The vulnerability is caused when a Windows kernel-mode driver, the Win32k TrueType font parsing engine, fails to properly handle the TrueType font type, Microsoft said. Microsoft said the vulnerability could be exploited various ways, such as providing documents or luring users to a Web page that embeds TrueType. A specially crafted TrueType font could then exploit the vulnerability.

The company said the vulnerability cannot be exploited automatically through e-mail; a user must open an attachment or visit a site to become infected.

According to the Common Vulnerabilities and Exposures database, the vulnerability is as yet unspecified but exists in the kernel in Microsoft Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista SP2; Windows Server 2008 SP2, R2, and R2 SP1; and Windows 7 Gold and SP1. It allows the remote execution of arbitrary code via crafted font data in a Word document, and it has been exploited in the wild by Duqu.

The Microsoft advisory provides instructions for denying access to the driver and for undoing the workaround, along with the option of having the workaround automatically applied through Microsoft Fix It.

Symantec has called Duqu “essentially the precursor to a future Stuxnet-like attack,” which now is operating in an information-gathering phase. The number of confirmed infections is limited, but it has spread in six possible organizations in eight countries: France, the Netherlands, Switzerland, Ukraine, India, Iran, Sudan and Vietnam. Other security vendors have reported infections in Austria, Hungary, Indonesia, the United Kingdom and Iran.

The exact number of organizations and their identities are not known because some addresses are traceable only to a service provider. This also makes it difficult to say why these organizations have been targeted and what the goal of the campaign is, Symantec researchers said.

Duqu can spread within networks, and one of its interesting features is the ability to communicate with a command and control server when installed on a computer without direct Internet access. It creates a bridge using other infected computers as proxies with Internet access, allowing attackers to control infections in secure zones.

About the Author

William Jackson is the senior writer for Government Computer News (


  • Microsoft Hires Movial To Build Android OS for Microsoft Devices

    Microsoft has hired the Romanian operations of software engineering and design services company Movial to develop an Android-based operating system solution for the Microsoft Devices business segment.

  • Microsoft Ending Workflows for SharePoint 2010 Online Next Month

    Microsoft on Monday gave notice that it will be ending support this year for the "workflows" component of SharePoint 2010 Online, as well as deprecating that component for SharePoint 2013 Online.

  • Why Windows Phone Is Dead, But Not Completely Gone

    Don't call it a comeback (because that's not likely). But as Brien explains, there are three ways that today's smartphone market leaves the door open for Microsoft to bring Windows back to smartphones.

  • Feature Update Deferral Mix-Up in Windows 10 Version 2004 Further Explained

    Microsoft last week described the confusion it is attempting to avoid by removing the client graphical user interface (GUI)-based controls to defer Windows 10 feature updates, starting with version 2004.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.