eEye Advisory - EEYEB-20050316 - HTML Help File Parsing Buffer Overflow

From: Steve Manzuik (smanzuik_at_eeye.com)
Date: 06/15/05

  • Next message: Jamie Pratt: "Re: is this new? vuln info @ Adobe" 
    Date: Wed, 15 Jun 2005 11:27:08 -0700
To: <bugtraq@securityfocus.com>

    EEYEB-20050316 - HTML Help File Parsing Buffer Overflow

    Release Date:
    June 14, 2005

    Date Reported:
    March 16, 2005

    Severity:
    High (Remote Code Execution)

    Vendor:
    Microsoft

    Systems Affected:
    Windows 98 / 98 SE
    Windows Me
    Windows 2000 Service Pack 3 / Service Pack 4
    Windows XP Service Pack 1 / Service Pack 2
    Windows XP 64-Bit Itanium SP 1
    Windows XP 64-Bit Itanium 2003
    Windows XP Professional x64 Edition
    Windows 2003 Server / Service Pack 1
    Windows 2003 for Itanium / Service Pack 1
    Windows 2003 x64 Edition

    Overview:
    eEye Digital Security has discovered a vulnerability in the way various
    versions of Windows handle Windows Help (.CHM) files. If exploited,
    this vulnerability allows arbitrary code to be executed by the remote
    attacker. A malicious .CHM file can be opened by Internet Explorer
    without user interaction by using the "ms-its" protocol specification;
    for example:

    ms-its:\\server\\file.chm:/label.htm

    This vulnerability affects any application that uses the Windows Help
    component of Internet Explorer internally.

    Technical Details:
    A CHM file can be specially crafted in order to cause a heap overflow,
    leading to one of the following exploitable situations:

    (1) 1A40C0DD call dword ptr [ecx+18h] : we can control ECX, EAX points
    to our buffer

    (2) 717AA58C call dword ptr [ecx+4] : we can control ECX, EAX points
    to our buffer

    (3) 77F8C7A9 mov dword ptr [ecx],eax : we can control ECX and EAX,
    EDI points to our buffer

    This heap overflow is caused by an integer overflow in a size field.
    Specifying a very high DWORD value (e.g., 0xFFFFFFFD) in this field will
    cause a buffer overflow and an excessive memory copy that overwrites all
    contiguous heap memory and eventually reaches a page boundary.

    Protection:
    Retina Network Security Scanner has been updated to identify this
    vulnerability.
    Blink Endpoint Protection defends against this vulnerability.

    Vendor Status:
    Microsoft has released a patch for this vulnerability. The patch is
    available at:
    http://www.microsoft.com/technet/security/bulletin/MS05-026.mspx

    Credit:
    Discovery: Yuji Ukai

    Related Links:

    Retina Network Security Scanner - Free 15 Day Trial
    http://www.eeye.com/html/products/retina/download/index.html

    Retina Network Security Scanner - Japanese Edition
    http://www.sse.co.jp/eeye/index.html

    Greetings:
    SSE Retina Team, All attendees of the workshop at Triton Square,
    WAIGAYA@Ichigaya

    Copyright (c) 1998-2005 eEye Digital Security
    Permission is hereby granted for the redistribution of this alert
    electronically. It is not to be edited in any way without express
    consent of eEye. If you wish to reprint the whole or any part of this
    alert in any other medium excluding electronic medium, please email
    alert@eEye.com for permission.

    Disclaimer
    The information within this paper may change without notice. Use of this
    information constitutes acceptance for use in an AS IS condition. There
    are no warranties, implied or express, with regard to this information.
    In no event shall the author be liable for any direct or indirect
    damages whatsoever arising out of or in connection with the use or
    spread of this information. Any use of this information is at the user's
    own risk.

  • Next message: Jamie Pratt: "Re: is this new? vuln info @ Adobe"

    Relevant Pages

    • CORE-20020618: Vulnerabilities in Windows SMB (DoS)
      ... Denial of Service Vulnerabilities in Windows SMB implementation ... mechanism for client systems to request file services from server ... It might be possible to abuse this vulnerability to execute arbitrary ... Later in the processing of the request, at SRV.SYS+33209h another buffer ...
      (NT-Bugtraq)
    • CORE-20020618: Vulnerabilities in Windows SMB (DoS)
      ... Denial of Service Vulnerabilities in Windows SMB implementation ... mechanism for client systems to request file services from server ... It might be possible to abuse this vulnerability to execute arbitrary ... Later in the processing of the request, at SRV.SYS+33209h another buffer ...
      (Bugtraq)
    • [NT] Unchecked buffer in the Multiple UNC Provider Could Enable Code Execution
      ... The MUP receives commands containing UNC names from ... There is proper input checking in this first buffer. ... * Microsoft Windows NT 4.0 Workstation ... the vulnerability could only be exploited by a user who could ...
      (Securiteam)
    • Re: newbie: I/O with nasm
      ... BOOL ReadFile( ... BOOL WriteFile( ... Now, if Windows is what TK is looking for, we've got something to go on. ... Pointer to the buffer that receives the data read from the file. ...
      (alt.lang.asm)
    • Re: Unchecked Buffer
      ... >where Windows allows a VIRUS can inject itself in the stack stack and the ... Additionally not all buffer overruns are quite this simple to spot. ... If UNICODE is defined then this is an overflow because sizeofwill ...
      (microsoft.public.security)
    • Quantcast