Vulnerability Note VU#543864

Microsoft Windows Program Group Converter vulnerable to buffer overflow

Overview

Microsoft Program Group Converter contains a buffer overflow that may allow an attacker to execute arbitrary code.

I. Description

Microsoft describes Program Group Converter (grpconv.exe) as a application to "convert Program Manager Group files [.grp extention] that were created in Windows 3.1, Windows 3.11, Windows for Workgroups 3.1, and Windows for Workgroups 3.11 so that they could be used by later operating systems. This application is also used during Windows Setup and by third-party applications during the installation of applications or devices."

A vulnerability has been discovered in Microsoft's Program Group Converter. Quoting from Microsoft Security Bulletin MS04-037:

A remote code execution vulnerability exists in Program Group Converter because of the way that it handles specially crafted requests. An attacker could exploit the vulnerability by constructing a malicious request that could potentially allow remote code execution if a user performed an action such as opening a file attachment or clicking a HTML link. If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.

For further technical information about this vulnerability, please see Microsoft Security Bulletin MS04-037.

II. Impact

If a remote attacker can persuade a user to access a specially crafted Program Group (.grp) file that, the attacker may be able to execute arbitrary code on the compromised system, possibly with administrator privileges.

III. Solution

Apply Patch

Apply a patch as described in Microsoft Security Bulletin MS04-037. Please also note that Microsoft is actively deploying the patches for this vulnerability via Windows Update.

Do Not Accept '.grp' Files from Untrusted Sources

Exploitation occurs by accessing a specially crafted Program Group (.grp) file . By only accepting .grp files from trusted or known sources, the chances of exploitation are reduced.

For more details regarding remediation of this issue please see Microsoft Security Bulletin MS04-037.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	13-Oct-2004

References

http://www.microsoft.com/technet/security/bulletin/MS04-037.mspx
http://securitytracker.com/alerts/2004/Oct/1011646.html

Credit

Microsoft has published Microsoft Security Bulletin MS04-037 to address this vulnerability.

This document was written by Jeff Gennari.

Other Information

Date Public:	2004-10-12
Date First Published:	2004-10-15
Date Last Updated:	2004-10-15
CERT Advisory:
CVE-ID(s):	CAN-2004-0572
NVD-ID(s):	CAN-2004-0572
US-CERT Technical Alerts:
Metric:	25.30
Document Revision:	64

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader