Research Archives > Security Advisories > AD20050614

HTML Help File Parsing Buffer Overflow

Release Date:
6/14/2005 12:00:00 AM

Date Reported:
3/16/2005 12:00:00 AM

Severity:
High

Vendor:
Microsoft

Affected Software:
Windows 98 / 98 SE
Windows Me
Windows 2000
Windows XP
Windows 2003

Overview:
eEye Digital Security has discovered a vulnerability in the way various versions of Windows handle Windows Help (.CHM) files. If exploited, this vulnerability allows arbitrary code to be executed by the remote attacker. A malicious .CHM file can be opened by Internet Explorer without user interaction by using the "ms-its" protocol specification.

Technical Details:
eEye Digital Security has discovered a vulnerability in the way various versions of Windows handle Windows Help (.CHM) files. If exploited, this vulnerability allows arbitrary code to be executed by the remote attacker. A malicious .CHM file can be opened by Internet Explorer without user interaction by using the "ms-its" protocol specification; for example:

ms-its:\\server\\file.chm:/label.htm

This vulnerability affects any application that uses the Windows Help component of Internet Explorer internally.


Technical Details:
A CHM file can be specially crafted in order to cause a heap overflow, leading to one of the following exploitable situations:

(1) 1A40C0DD call dword ptr [ecx+18h] : we can control ECX, EAX points to our buffer

(2) 717AA58C call dword ptr [ecx+4] : we can control ECX, EAX points to our buffer

(3) 77F8C7A9 mov dword ptr [ecx],eax : we can control ECX and EAX, EDI points to our buffer

This heap overflow is caused by an integer overflow in a size field. Specifying a very high DWORD value (e.g., 0xFFFFFFFD) in this field will cause a buffer overflow and an excessive memory copy that overwrites all contiguous heap memory and eventually reaches a page boundary.

Protection:
Retina Network Security Scanner has been updated to identify this vulnerability.
Blink - Endpoint Vulnerability Prevention - preemptively protects from this vulnerability.

Vendor Status:
Microsoft has released a patch for this vulnerability. The patch is available at: http://www.microsoft.com/technet/security/bulletin/MS05-026.mspx.

Credit:
Yuji Ukai

Greetings:
SSE Retina Team, All attendees of the workshop at Triton Square, WAIGAYA@Ichigaya

Copyright ©1998-2011 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.