Microsoft HTML Help Workshop buffer overflow

Overview

A buffer overflow in Microsoft HTML Help Workshop may allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

Microsoft HTML Help provides a standard help system for the Windows operating system. HTML Help Workshop is a component of the software development kit for HTML Help. A lack of validation on the Contents file field within HTML Help Workshop Project files headers may allow a stack-based buffer overflow to occur. Note that Microsoft HTML Help Workshop is not installed by default on any version of Microsoft Windows.

Exploit code for this vulnerability is publicly available.

---

Impact

By persuading a user to access a specially crafted HTML Help Workshop Project files (.hhp), a remote attacker may be able to execute arbitrary code.

---

Solution

We are unaware of a practical solution to this problem, however we suggest the following workaround to reduce the chances of exploitation:

---

Do not access HTML Help Workshop Project files from untrusted sources

Exploitation occurs if a user has the HTML Help SDK installed and accesses a specially crafted HTML Help Workshop Project file. By only accessing Help Workshop Project files from known and trusted sources, the chances of exploitation are reduced.

---

Vendor Information

124460

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation Affected

Updated: February 13, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://users.pandora.be/bratax/advisories/b008.html&gt;
• <http://secunia.com/advisories/18740/&gt;
• <http://eagle.blacksecurity.org/stuff/unl0ck/adv/55k700106.txt.&gt;
• <http://msdn.microsoft.com/library/default.asp?url=/library/en-us/htmlhelp/html/vsconHH1Start.asp&gt;
• <http://archives.neohapsis.com/archives/ntbugtraq/2005-q2/0056.html&gt;

Acknowledgements

This vulnerability was reported by bratax.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2006-0564
Severity Metric:	17.08 Date Public: