Software Engineering Institute

Microsoft describes Program Group Converter (grpconv.exe) as a application to "convert Program Manager Group files [.grp extention] that were created in Windows 3.1, Windows 3.11, Windows for Workgroups 3.1, and Windows for Workgroups 3.11 so that they could be used by later operating systems. This application is also used during Windows Setup and by third-party applications during the installation of applications or devices."

A vulnerability has been discovered in Microsoft's Program Group Converter. Quoting from Microsoft Security Bulletin MS04-037:

A remote code execution vulnerability exists in Program Group Converter because of the way that it handles specially crafted requests. An attacker could exploit the vulnerability by constructing a malicious request that could potentially allow remote code execution if a user performed an action such as opening a file attachment or clicking a HTML link. If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.

For further technical information about this vulnerability, please see Microsoft Security Bulletin MS04-037.

If a remote attacker can persuade a user to access a specially crafted Program Group (.grp) file that, the attacker may be able to execute arbitrary code on the compromised system, possibly with administrator privileges.

Apply Patch

Apply a patch as described in Microsoft Security Bulletin MS04-037. Please also note that Microsoft is actively deploying the patches for this vulnerability via Windows Update.

Do Not Accept '.grp' Files from Untrusted Sources

Exploitation occurs by accessing a specially crafted Program Group (.grp) file . By only accepting .grp files from trusted or known sources, the chances of exploitation are reduced.

For more details regarding remediation of this issue please see Microsoft Security Bulletin MS04-037.