Microsoft Help
Workshop .HPJ File Buffer Overflow Vulnerability
Date Discovered:
01/24/2007
Severity:
High
Operating Systems:
Microsoft Visual Studio
6.0 SP6
Microsoft Help Workshop 4.3.2
Synopsis
Stack based buffer overflow
in Microsoft Help Workshop 4.3.2 allows user assisted remote attackers
to execute arbitrary code via a help project .hpj file with a long HLP
field in the OPTIONS section.
iPolicy Networks
Response
iPolicy Networks IPF provides
detection of this vulnerability by the following signatures:
Microsoft help workshop fails to properly
bounds check user supplied input in .hpj project files.
An attacker may use a malformed '.hpj' file containing an unusually
long string to cause a stack based buffer overflow, allowing the
execution of arbitrary code.
The problem lies in lack of boundary check of file path variables in
the 'HLP' field of 'OPTIONS' section. When the string length exceeds
256 bytes, programs static buffer is overflowed and its memory in
corrupted.
