Microsoft Windows Server 2000 < 2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)

ExploitDBExploitDB exploitScannerEDB-10068

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module serves an HTML page that references a crafted Embedded OpenType (EOT) font. When the font is requested, the module patches the 'cmap' table directory entry with an offset and length that overflow when combined, triggering a Blue Screen of Death (BSoD) in vulnerable Windows systems. The module does not execute arbitrary code; it only triggers a denial-of-service condition.

Backdoor review

No backdoor observed in reviewed code

The supplied Ruby script is a Metasploit auxiliary module that triggers a known integer overflow (CVE-2009-2514) in the Windows EOT font parser to cause a Blue Screen of Death (BSoD). It serves a crafted EOT font via HTTP. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The code is straightforward and its actions are consistent with the stated denial-of-service purpose.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesruby
Target softwareMicrosoft Windows win32k.sys
Attack typesdenial-of-service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module only triggers a BSoD (denial-of-service) by causing an integer overflow in font parsing; it does not contain any payload or code execution mechanism. The description states it 'triggers a BSoD' and the crash dump confirms a driver fault, not arbitrary code execution. This is consistent with a scanner that validates the vulnerability by causing a crash.

exploits/windows/dos/10068.rb:24-27exploits/windows/dos/10068.rb:95-165

Requirements

  • Victim must visit the attacker's web page with Internet Explorer on a vulnerable Windows system.exploits/windows/dos/10068.rb:26-27

Observed behavior

  • Starts an HTTP server and serves an HTML page with an @font-face CSS rule referencing a crafted EOT font.exploits/windows/dos/10068.rb:76-84
  • When the font is requested, reads a base EOT file, locates the 'cmap' table, and overwrites its offset and length fields with values that cause an integer overflow.exploits/windows/dos/10068.rb:54-65
  • Sends the modified font to the client, which triggers a BSoD when parsed by the kernel's win32k.sys.exploits/windows/dos/10068.rb:68-69exploits/windows/dos/10068.rb:95-165
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Serves a modified EOT font to trigger CVE-2009-2514 integer overflow leading to BSoDThe module reads a template EOT file, patches the 'cmap' table offset and length to cause an integer overflow, and sends it to the requesting client. This matches the described vulnerability and the module's stated purpose.exploits/windows/dos/10068.rb:50-69
Network Behavior
HTTP server that serves an HTML page with an embedded font reference, then serves the crafted fontThe module sets up an HTTP server. On the first request, it returns an HTML page with a CSS @font-face rule pointing to the crafted font. On the second request (matching a random tag), it returns the patched EOT file. This is standard Metasploit auxiliary module behavior.exploits/windows/dos/10068.rb:50-85
File Operation
Reads an EOT template file from diskThe module reads a local EOT file specified by the EOTFILE option (default pricedown.eot) to use as a template for the exploit. This is a normal file read operation for an exploit module.exploits/windows/dos/10068.rb:41exploits/windows/dos/10068.rb:52
Review boundaries

What the analysis did not establish

  • Only the single Ruby file is provided; the base EOT template file (pricedown.eot) is not included, so the exact unmodified font structure cannot be verified.
  • The analysis is based solely on static code review; the module was not executed, and its runtime behavior is inferred from the source code and embedded crash dump comments.
  • The analysis is limited to the supplied text of the Ruby script. The referenced external EOT template file (pricedown.eot) is not included in the evidence and was not inspected.
  • Binary content within the EOT file, if any, is not analyzed; only the patching logic in the script is reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1