lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: thor at (Thor Larholm)
Subject: Thor Larholm security advisory TL#004

Thor Larholm security advisory TL#004

Topic: Windows Help buffer overflow

Discovery date: 31 July 2002

Affected applications

Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows Millennium Edition
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0, Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP

Severity: High

Arbitrary code execution, taking any action the user has privileges to
perform on the system.

The Windows Help Facility exposes itself both as an ActiveX component and as
a part of Internet Explorer through the showHelp method. The showHelp
method, taking a URI as argument, has a fixed buffer that is easily
overflowed from a webpage or within an email.

The size of the fixed buffer varies for each Windows version, most likely
due to a dependency on a systemspecific variant size. This factor is not
mitigating in itself. The variance of this size is fixed and the overflow is
traditional. It is our belief that this overflow must be wellknown already
in the wild, as simple reallife usages of the showHelp method (using a
moderately long URI) would easily expose the existance of this

Due to this belief, we feel that it will benefit and empower endusers more
if they are able to easily verify for themselves whether they are using a
vulnerable version of Windows Help. Others have recently made the public
aware of this vulnerability as well, though without disclosing any actual


<script>showHelp( A*796 );</script>

Apply the MS02-055 patch.

I have put together some proof-of-concept examples. These do not run any
meaningful code but merely overflows the buffer with a lot of A characters.

Simple, oneclick testcase
Try your own numbers

Vendor status:
Microsoft was notified 31 July 2002, they released MS02-055 on October 2,

Thor Larholm, Security Researcher
PivX Solutions, LLC

Are You Secure?

Powered by blists - more mailing lists