search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Microsoft Windows Program Group Converter vulnerable to buffer overflow

Vulnerability Note VU#543864

Original Release Date: 2004-10-15 | Last Revised: 2004-10-15


Microsoft Program Group Converter contains a buffer overflow that may allow an attacker to execute arbitrary code.


Microsoft describes Program Group Converter (grpconv.exe) as a application to "convert Program Manager Group files [.grp extention] that were created in Windows 3.1, Windows 3.11, Windows for Workgroups 3.1, and Windows for Workgroups 3.11 so that they could be used by later operating systems. This application is also used during Windows Setup and by third-party applications during the installation of applications or devices."

A vulnerability has been discovered in Microsoft's Program Group Converter. Quoting from Microsoft Security Bulletin MS04-037:

A remote code execution vulnerability exists in Program Group Converter because of the way that it handles specially crafted requests. An attacker could exploit the vulnerability by constructing a malicious request that could potentially allow remote code execution if a user performed an action such as opening a file attachment or clicking a HTML link. If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.

For further technical information about this vulnerability, please see Microsoft Security Bulletin MS04-037.


If a remote attacker can persuade a user to access a specially crafted Program Group (.grp) file that, the attacker may be able to execute arbitrary code on the compromised system, possibly with administrator privileges.


Apply Patch

Apply a patch as described in Microsoft Security Bulletin MS04-037. Please also note that Microsoft is actively deploying the patches for this vulnerability via Windows Update.

Do Not Accept '.grp' Files from Untrusted Sources

Exploitation occurs by accessing a specially crafted Program Group (.grp) file . By only accepting .grp files from trusted or known sources, the chances of exploitation are reduced.

For more details regarding remediation of this issue please see Microsoft Security Bulletin MS04-037.

Vendor Information


Microsoft Corporation Affected

Updated:  October 13, 2004



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Please see Microsoft Security Bulletin MS04-037 to address this vulnerability.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Microsoft has published Microsoft Security Bulletin MS04-037 to address this vulnerability.

This document was written by Jeff Gennari.

Other Information

CVE IDs: CVE-2004-0572
Severity Metric: 25.30
Date Public: 2004-10-12
Date First Published: 2004-10-15
Date Last Updated: 2004-10-15 15:22 UTC
Document Revision: 64

Sponsored by CISA.