full-disclosure - [Bkis-05-2009] PowerCHM Stack-based Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <49CB1241.6060905@bkav.com.vn>
Date: Thu, 26 Mar 2009 12:27:29 +0700
From: Bkis <svrt@...v.com.vn>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [Bkis-05-2009] PowerCHM Stack-based Buffer
	Overflow

PowerCHM Stack-based Buffer Overflow

1. General Information

PowerCHM is a tool that can create CHM files from Html Files, Text 
Files, Microsoft Word Documents and Adobe Acrobat Document.

In March 2009, Bkis has just detected a vulnerability in the software, 
related to the processing of PowerCHM project files with extension 
“.HHP”. Hackers can exploit this flaw to execute any program, install 
viruses, steal private information, and even take control of users’ 
systems. We sent the report to the vendor.

Details : http://security.bkis.vn/?p=365
SVRT Advisory : Bkis-05-2009
Initial vendor notification : 03/14/2009
Release Date : 03/26/2009
Update Date : 03/26/2009
Discovered by : Le Duc Anh, Bkis
Attack Type : Buffer Overflow
Security Rating : Critical
Impact : Code Execution
Affected Software : PowerCHM 5.7 (Prior versions may be also affected)

2. Technical Description

The vulnerability exists in the way that PowerCHM processes CHM project 
files. When opening an “HHP” file with an overly long text field such as 
[WINDOWS], [FILES]. it will lead to a critical stack-based overflow.

Technically, it’s very easy for hackers to exploit this flaw. A hacker 
might craft an “HHP” file with malicious code embedded and trick users 
into opening it. If successful, the hacker might execute arbitrary code 
on the affected application.

3. Solution

Rating this vulnerability high severity and due to the fact that the 
manufacturer hasn’t released any official patch for PowerCHM, Bkis 
recommends that users be cautious with “HHP” files from untrustworthy 
sources until the vendor release the patch.

Bkis (www.bkis.vn)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/