Microsoft Windows help viewer vulnerable to heap overflow

Overview

A vulnerability exists in the Microsoft Windows help viewer application that could allow a remote attacker to execute code of their choosing on a vulnerable system.

Description

The Microsoft Windows help viewer (winhlp32.exe) provides application assistance to users through a special type of file (.hlp). The help file format allows for compression of frequently used phrases. When this feature is employed, information about phrases, including size and number, is stored in a table in the help file. An unsafe use of information supplied during decoding of the phrase table could result in an incorrect memory allocation. This error results in a heap memory overflow that can be exploited by a malformed help file that specifies an invalid size in the phrase table.

Note that this vulnerability may only affect versions of Microsoft Windows with certain language packs installed. The full scope of affected systems is unclear at the current time.

---

Impact

A remote attacker may be able to execute arbitrary code on a vulnerable system through a maliciously crafted help file (.hlp). The malicious file could be introduced to a victim user through a web site or an email message. The intruder-supplied code would be run with the privileges of the user who opened the malicious help file.

---

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

---

Workarounds

As always, best practices dictate careful handling of all files received from unknown sources. Users should not open help files from unknown or potentially malicious sources.

---

Vendor Information

115632

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Unknown

Notified: January 10, 2005 Updated: January 18, 2005

Status

Unknown

Vendor Statement

Thank you for your note. A buffer overflow is not needed to execute code with a .hlp file. A .hlp file type as referred to in the public report is for the most part equivalent to a .exe file and therefore is able to execute code as part of is documented functionality. There is no remote angle to this report, the attacker must persuade the target to download and execute the malicious file. Essentially, what flashsky is saying is if I can get a .exe file on your machine, I can execute code.

On another note, please reconsider using the word “Thanks” in the credit section as this issue was not responsibly disclosed to Microsoft.

Kind regards,
Brian

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23115632 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.securityfocus.com/archive/1/385332&gt;
• <http://www.xfocus.net/flashsky/icoExp/index.html&gt;
• <http://secunia.com/advisories/13645/&gt;

Acknowledgements

Thanks to flashsky fangxing for reporting this vulnerability.

This document was written by Ken MacInnis.

Other Information

CVE IDs:	CVE-2004-1306
Severity Metric:	15.68 Date Public: