Signature Detail

HTTP: Microsoft Windows HLP File Handling Heap Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Microsoft Windows Help. A successful attack can lead to arbitrary code execution.

Extended Description

The Microsoft Windows Help File viewer is reported prone to a heap-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data into insufficiently sized memory buffers. This vulnerability presents itself when the application handles a specially crafted Windows Help ('.hlp') file. A successful attack may facilitate arbitrary code execution in the context of a vulnerable user who opens a malicious file. Failed exploit attempts will likely result in denial-of-service conditions.

Affected Products

• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server SP3
• Microsoft windows_2000_advanced_server SP4
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server SP3
• Microsoft windows_2000_datacenter_server SP4
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional SP3
• Microsoft windows_2000_professional SP4
• Microsoft windows_2000_professional
• Microsoft windows_2000_resource_kit
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server SP3
• Microsoft windows_2000_server SP4
• Microsoft windows_2000_server
• Microsoft windows_2000_server_japanese_edition
• Microsoft windows_2000_terminal_services SP1
• Microsoft windows_2000_terminal_services SP2
• Microsoft windows_2000_terminal_services SP3
• Microsoft windows_2000_terminal_services SP4
• Microsoft windows_2000_terminal_services
• Microsoft windows_nt 4.0
• Microsoft windows_nt 4.0 alpha
• Microsoft windows_nt 4.0 SP1
• Microsoft windows_nt 4.0 SP1 alpha
• Microsoft windows_nt 4.0 SP2
• Microsoft windows_nt 4.0 SP2 alpha
• Microsoft windows_nt 4.0 SP3
• Microsoft windows_nt 4.0 SP3 alpha
• Microsoft windows_nt 4.0 SP4
• Microsoft windows_nt 4.0 SP4 alpha
• Microsoft windows_nt 4.0 SP5
• Microsoft windows_nt 4.0 SP5 alpha
• Microsoft windows_nt 4.0 SP6
• Microsoft windows_nt 4.0 SP6a
• Microsoft windows_nt 4.0 SP6a alpha
• Microsoft windows_nt 4.0 SP6 alpha
• Microsoft windows_nt_enterprise_server 4.0
• Microsoft windows_nt_enterprise_server 4.0 SP1
• Microsoft windows_nt_enterprise_server 4.0 SP2
• Microsoft windows_nt_enterprise_server 4.0 SP3
• Microsoft windows_nt_enterprise_server 4.0 SP4
• Microsoft windows_nt_enterprise_server 4.0 SP5
• Microsoft windows_nt_enterprise_server 4.0 SP6
• Microsoft windows_nt_enterprise_server 4.0 SP6a
• Microsoft windows_nt_server 4.0
• Microsoft windows_nt_server 4.0 SP1
• Microsoft windows_nt_server 4.0 SP2
• Microsoft windows_nt_server 4.0 SP3
• Microsoft windows_nt_server 4.0 SP4
• Microsoft windows_nt_server 4.0 SP5
• Microsoft windows_nt_server 4.0 SP6
• Microsoft windows_nt_server 4.0 SP6a
• Microsoft windows_nt_terminal_server 4.0
• Microsoft windows_nt_terminal_server 4.0 SP1
• Microsoft windows_nt_terminal_server 4.0 SP2
• Microsoft windows_nt_terminal_server 4.0 SP3
• Microsoft windows_nt_terminal_server 4.0 SP4
• Microsoft windows_nt_terminal_server 4.0 SP5
• Microsoft windows_nt_terminal_server 4.0 SP6
• Microsoft windows_nt_terminal_server 4.0 SP6a
• Microsoft windows_nt_workstation 4.0
• Microsoft windows_nt_workstation 4.0 SP1
• Microsoft windows_nt_workstation 4.0 SP2
• Microsoft windows_nt_workstation 4.0 SP3
• Microsoft windows_nt_workstation 4.0 SP4
• Microsoft windows_nt_workstation 4.0 SP5
• Microsoft windows_nt_workstation 4.0 SP6
• Microsoft windows_nt_workstation 4.0 SP6a
• Microsoft windows_server_2003_datacenter_edition SP1
• Microsoft windows_server_2003_datacenter_edition SP1 Beta 1
• Microsoft windows_server_2003_datacenter_edition
• Microsoft windows_server_2003_datacenter_edition_itanium SP1
• Microsoft windows_server_2003_datacenter_edition_itanium SP1 Beta 1
• Microsoft windows_server_2003_datacenter_edition_itanium
• Microsoft windows_server_2003_datacenter_x64_edition SP2
• Microsoft windows_server_2003_datacenter_x64_edition
• Microsoft windows_server_2003_enterprise_edition SP1
• Microsoft windows_server_2003_enterprise_edition SP1 Beta 1
• Microsoft windows_server_2003_enterprise_edition
• Microsoft windows_server_2003_enterprise_edition_itanium SP1
• Microsoft windows_server_2003_enterprise_edition_itanium SP1 Beta 1
• Microsoft windows_server_2003_enterprise_edition_itanium
• Microsoft windows_server_2003_enterprise_x64_edition SP2
• Microsoft windows_server_2003_enterprise_x64_edition
• Microsoft windows_server_2003_itanium SP1
• Microsoft windows_server_2003_itanium SP2
• Microsoft windows_server_2003_itanium
• Microsoft windows_server_2003_standard_edition SP1
• Microsoft windows_server_2003_standard_edition SP1 Beta 1
• Microsoft windows_server_2003_standard_edition SP2
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_standard_x64_edition
• Microsoft windows_server_2003_web_edition SP1
• Microsoft windows_server_2003_web_edition SP1 Beta 1
• Microsoft windows_server_2003_web_edition SP2
• Microsoft windows_server_2003_web_edition
• Microsoft windows_xp
• Microsoft windows_xp_64-bit_edition SP1
• Microsoft windows_xp_64-bit_edition
• Microsoft windows_xp_64-bit_edition_version_2003 SP1
• Microsoft windows_xp_64-bit_edition_version_2003
• Microsoft windows_xp_embedded SP1
• Microsoft windows_xp_embedded
• Microsoft windows_xp_gold
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition SP2
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional
• Microsoft windows_xp_professional_x64_edition SP2
• Microsoft windows_xp_professional_x64_edition
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition SP2
• Microsoft windows_xp_tablet_pc_edition

References

• BugTraq: 23382
• CVE: CVE-2007-1912