Signature Detail

HTTP: Malformed Microsoft HLP/CHM File

This signature detects attempts to exploit a known vulnerability in the Microsoft Help file format. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

The Microsoft Windows Help File viewer (winhlp32.exe) is reported prone to a heap-overflow vulnerability. This vulnerability presents itself when the application handles a specially crafted Windows Help (.hlp) file. A successful attack may facilitate arbitrary code execution in the context of a vulnerable user who opens a malicious file.

Affected Products

• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server SP3
• Microsoft windows_2000_advanced_server SP4
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server SP3
• Microsoft windows_2000_datacenter_server SP4
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional SP3
• Microsoft windows_2000_professional SP4
• Microsoft windows_2000_professional
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server SP3
• Microsoft windows_2000_server SP4
• Microsoft windows_nt_enterprise_server 4.0
• Microsoft windows_nt_enterprise_server 4.0 SP1
• Microsoft windows_nt_enterprise_server 4.0 SP2
• Microsoft windows_nt_enterprise_server 4.0 SP3
• Microsoft windows_nt_enterprise_server 4.0 SP4
• Microsoft windows_nt_enterprise_server 4.0 SP5
• Microsoft windows_nt_enterprise_server 4.0 SP6
• Microsoft windows_nt_enterprise_server 4.0 SP6a
• Microsoft windows_nt_server 4.0
• Microsoft windows_nt_server 4.0 SP1
• Microsoft windows_nt_server 4.0 SP2
• Microsoft windows_nt_server 4.0 SP3
• Microsoft windows_nt_server 4.0 SP4
• Microsoft windows_nt_server 4.0 SP5
• Microsoft windows_nt_server 4.0 SP6
• Microsoft windows_nt_server 4.0 SP6a
• Microsoft windows_nt_terminal_server 4.0
• Microsoft windows_nt_terminal_server 4.0 SP1
• Microsoft windows_nt_terminal_server 4.0 SP2
• Microsoft windows_nt_terminal_server 4.0 SP3
• Microsoft windows_nt_terminal_server 4.0 SP4
• Microsoft windows_nt_terminal_server 4.0 SP5
• Microsoft windows_nt_terminal_server 4.0 SP6
• Microsoft windows_nt_terminal_server 4.0 SP6a
• Microsoft windows_nt_workstation 4.0
• Microsoft windows_nt_workstation 4.0 SP1
• Microsoft windows_nt_workstation 4.0 SP2
• Microsoft windows_nt_workstation 4.0 SP3
• Microsoft windows_nt_workstation 4.0 SP4
• Microsoft windows_nt_workstation 4.0 SP5
• Microsoft windows_nt_workstation 4.0 SP6
• Microsoft windows_nt_workstation 4.0 SP6a
• Microsoft windows_server_2003_datacenter_edition SP1
• Microsoft windows_server_2003_datacenter_edition
• Microsoft windows_server_2003_enterprise_edition SP1
• Microsoft windows_server_2003_enterprise_edition
• Microsoft windows_server_2003_standard_edition SP1
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_web_edition SP1
• Microsoft windows_server_2003_web_edition
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition SP2
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional
• Microsoft windows_xp_tablet_pc_edition SP1
• Microsoft windows_xp_tablet_pc_edition SP2
• Microsoft windows_xp_tablet_pc_edition

References

• BugTraq: 17325
• BugTraq: 17926
• CVE: CVE-2006-1591
• CVE: CVE-2006-2297