Integer underflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file, which leads to a heap-based buffer overflow.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Windows_2000 | Microsoft | * | * |
| Windows_2003_server | Microsoft | enterprise (including) | enterprise (including) |
| Windows_2003_server | Microsoft | enterprise-sp1_beta_1 (including) | enterprise-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | enterprise_64-bit (including) | enterprise_64-bit (including) |
| Windows_2003_server | Microsoft | r2 (including) | r2 (including) |
| Windows_2003_server | Microsoft | r2-sp1_beta_1 (including) | r2-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | standard (including) | standard (including) |
| Windows_2003_server | Microsoft | standard-sp1_beta_1 (including) | standard-sp1_beta_1 (including) |
| Windows_2003_server | Microsoft | web (including) | web (including) |
| Windows_2003_server | Microsoft | web-sp1_beta_1 (including) | web-sp1_beta_1 (including) |
| Windows_nt | Microsoft | 4.0 (including) | 4.0 (including) |
| Windows_nt | Microsoft | 4.0-sp1 (including) | 4.0-sp1 (including) |
| Windows_nt | Microsoft | 4.0-sp2 (including) | 4.0-sp2 (including) |
| Windows_nt | Microsoft | 4.0-sp3 (including) | 4.0-sp3 (including) |
| Windows_nt | Microsoft | 4.0-sp4 (including) | 4.0-sp4 (including) |
| Windows_nt | Microsoft | 4.0-sp5 (including) | 4.0-sp5 (including) |
| Windows_nt | Microsoft | 4.0-sp6 (including) | 4.0-sp6 (including) |
| Windows_nt | Microsoft | 4.0-sp6a (including) | 4.0-sp6a (including) |
| Windows_xp | Microsoft | * | * |
References
- http://marc.info/?l=bugtraq\u0026m=110383690219440\u0026w=2
- http://www.securityfocus.com/bid/12091
- http://www.xfocus.net/flashsky/icoExp/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18678
- http://marc.info/?l=bugtraq\u0026m=110383690219440\u0026w=2
- http://www.securityfocus.com/bid/12091
- http://www.xfocus.net/flashsky/icoExp/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18678