SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#115632

Microsoft Windows help viewer vulnerable to heap overflow

Overview

A vulnerability exists in the Microsoft Windows help viewer application that could allow a remote attacker to execute code of their choosing on a vulnerable system.

I. Description

The Microsoft Windows help viewer (winhlp32.exe) provides application assistance to users through a special type of file (.hlp). The help file format allows for compression of frequently used phrases. When this feature is employed, information about phrases, including size and number, is stored in a table in the help file. An unsafe use of information supplied during decoding of the phrase table could result in an incorrect memory allocation. This error results in a heap memory overflow that can be exploited by a malformed help file that specifies an invalid size in the phrase table.

Note that this vulnerability may only affect versions of Microsoft Windows with certain language packs installed.  The full scope of affected systems is unclear at the current time.

II. Impact

A remote attacker may be able to execute arbitrary code on a vulnerable system through a maliciously crafted help file (.hlp). The malicious file could be introduced to a victim user through a web site or an email message. The intruder-supplied code would be run with the privileges of the user who opened the malicious help file.

III. Solution

The CERT/CC is currently unaware of a practical solution to this problem.


Workarounds

As always, best practices dictate careful handling of all files received from unknown sources. Users should not open help files from unknown or potentially malicious sources.

Systems Affected

VendorStatusDate NotifiedDate Updated
Microsoft CorporationUnknown18-Jan-2005

References


http://www.securityfocus.com/archive/1/385332
http://www.xfocus.net/flashsky/icoExp/index.html
http://secunia.com/advisories/13645/

Credit

Thanks to flashsky fangxing for reporting this vulnerability.

This document was written by Ken MacInnis.

Other Information

Date Public:2004-12-23
Date First Published:2005-06-14
Date Last Updated:2005-06-22
CERT Advisory: 
CVE-ID(s):CAN-2004-1306
NVD-ID(s):CAN-2004-1306
US-CERT Technical Alerts: 
Metric:15.68
Document Revision:14

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader