Duqu Workaround Causing Graphics Driver Error

A workaround released by Microsoft to block a vulnerability that could lead to the Duqu worm installing itself is causing issues with graphics driver managing font displays.

The company said it is investigating the vulnerability, originally reported by Symantec and researchers in Budapest, and that a more permanent patch might be issued in the future. In the meantime, applications relying on embedded font technology could fail to display properly when using the workaround.

Duqu has gained attention because it appears to include source code from the Stuxnet worm, a sophisticated cyber weapon believed to have successfully attacked and damaged uranium refining equipment in Iran. Researchers from Symantec Security Response confirmed that Duqu is nearly identical to Stuxnet but initially were not able to determine how the malware installed itself.

The installer was recovered by the Laboratory of Cryptography and System Security at the Budapest University of Technology and Economics and analyzed by Symantec. The exploit in at least one case was delivered with the installer file in a Microsoft Word document attachment that had targeted the recipient.

The vulnerability is caused when a Windows kernel-mode driver, the Win32k TrueType font parsing engine, fails to properly handle the TrueType font type, Microsoft said. Microsoft said the vulnerability could be exploited various ways, such as providing documents or luring users to a Web page that embeds TrueType. A specially crafted TrueType font could then exploit the vulnerability.

The company said the vulnerability cannot be exploited automatically through e-mail; a user must open an attachment or visit a site to become infected.

According to the Common Vulnerabilities and Exposures database, the vulnerability is as yet unspecified but exists in the kernel in Microsoft Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista SP2; Windows Server 2008 SP2, R2, and R2 SP1; and Windows 7 Gold and SP1. It allows the remote execution of arbitrary code via crafted font data in a Word document, and it has been exploited in the wild by Duqu.

The Microsoft advisory provides instructions for denying access to the driver and for undoing the workaround, along with the option of having the workaround automatically applied through Microsoft Fix It.

Symantec has called Duqu “essentially the precursor to a future Stuxnet-like attack,” which now is operating in an information-gathering phase. The number of confirmed infections is limited, but it has spread in six possible organizations in eight countries: France, the Netherlands, Switzerland, Ukraine, India, Iran, Sudan and Vietnam. Other security vendors have reported infections in Austria, Hungary, Indonesia, the United Kingdom and Iran.

The exact number of organizations and their identities are not known because some addresses are traceable only to a service provider. This also makes it difficult to say why these organizations have been targeted and what the goal of the campaign is, Symantec researchers said.

Duqu can spread within networks, and one of its interesting features is the ability to communicate with a command and control server when installed on a computer without direct Internet access. It creates a bridge using other infected computers as proxies with Internet access, allowing attackers to control infections in secure zones.

About the Author

William Jackson is the senior writer for Government Computer News (


  • RAMBleed Side-Channel Attack Method Disclosed by Researchers

    Academic researchers this week published information about another side-channel attack method, called "RAMBleed," that can expose information from memory chips, including encryption key information.

  • Penguin

    Windows 10 Preview Build 18917 Shows Off New Linux Integration

    Microsoft's latest Windows 10 "fast-ring" preview release is showcasing a coming Delivery Optimization enhancement, along with the ability to try the newly emerged Windows Subsystem for Linux version 2.

  • Customizing Microsoft Office 365

    While the overall look and feel of Office 365 is pretty standard across organizations, there are several ways to personalize it and make it fit better with your company's specific needs.

  • Microsoft 365 Business Tenants Getting Conditional Access and Trouble-Ticket Features

    Microsoft added its conditional access security service to Microsoft 365 Business subscriptions, according to a Wednesday announcement, and it also added new trouble-ticket features for Microsoft 365 administrators.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.