NEWS: Microsoft Investigates HTML Help Flaw Warning [eWEEK]

[Grant Hogarth]

Microsoft Investigates HTML Help Flaw Warning
February 6, 2006

By  Ryan Naraine <mailto:ryan_naraine at ziffdavis.com>  
http://www.eweek.com/article2/0,1895,1920601,00.asp

Microsoft's security response team is investigating reports of a
remotely exploitable buffer overflow in HTML Help Workshop, the standard
help system for the Windows platform. 

The software vendor's investigation follows the public release of a
proof-of-concept exploit for the flaw, which is caused by a boundary
error within the handling of a ".hhp" file. 

Security alerts aggregator Secunia, <http://secunia.com/>  based in
Copenhagen, Denmark, rated the issue as "moderately critical" and warned
that a successful attack could cause harmful code to be executed when a
malicious .hhp file is opened. 

The vulnerable Microsoft HTML Help Workshop
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/htmlhe
lp/html/vsconHH1Start.asp>  is part of the Microsoft HTML Help 1.4 SDK
(software development kit) and is used to compress HTML, graphics files
and other types of files into a relatively small compiled help (.chm)
file. 

According to a published alert,
<http://users.pandora.be/bratax/advisories/b008.html>  an unchecked
buffer in the way HTML Help Workshop processes .hhp files allows a
remote user to take control of a target machine and execute arbitrary
code with the privileges of the user. 

The buffer overflow occurs when a long string is supplied as a contents
file. 

For advice on how to secure your network and applications, as well as
the latest security news, visit Ziff Davis Internet's Security IT Hub.
<http://security.ithub.com/>  

The vulnerability has been confirmed in HTML Help Workstation version
4.74.8702.0. Other versions may also be affected, Secunia warned. 

A spokesperson for Microsoft, based in Redmond, Wash., told eWEEK that
the company is not aware of any attacks attempting to use the reported
vulnerability. 

She said the initial investigation has revealed that customers who have
not installed the HTML Help SDK on their systems are not affected by the
public report. 

Microsoft joins the chorus warning about the "Blackworm" D-Day. Click
here to read more. 

"By default, no other Microsoft applications or operating systems have
the ability to open .hhp files," the spokesperson added. "Upon
completion of this investigation, Microsoft will take the appropriate
action to protect our customers, which may include issuing a security
advisory or providing a security update through our monthly release
process, depending on customer needs." 

The Microsoft HTML Help SDK is used to create online help for a software
application or to create content for a multimedia title or Web site.
Developers can use the HTML Help API to program a host application or
hook up context-sensitive help to an application. 

As an information delivery system, HTML Help is suited for a wide range
of additional applications, including training guides, interactive books
and electronic newsletters. 

Earlier this year, Microsoft released a security bulletin with patches
for a critical hole in the HTML Help ActiveX control in Windows. That
bug could have allowed an attacker to "take complete control of an
affected system" to load, manipulate or delete data. 

RELATED LINKS

*	Microsoft Joins 'Blackworm' D-Day Warning Chorus
<http://www.eweek.com/article2/0,1895,1917482,00.asp>  
*	Microsoft Hardens Vista Against Kernel-Mode Malware
<http://www.eweek.com/article2/0,1895,1914966,00.asp>  
*	Microsoft Plugs 'Critical' E-Mail Server Holes
<http://www.eweek.com/article2/0,1895,1909647,00.asp>  
*	Microsoft Ships 'Emergency' WMF Patch
<http://www.eweek.com/article2/0,1895,1908393,00.asp>  
*	Microsoft Patch Tuesday Cleans Up IE
<http://www.eweek.com/article2/0,1895,1901404,00.asp> 

Check out eWEEK.com's Security Center for the latest security news,
reviews and analysis. And for insights on security coverage around the
Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's
Weblog. <http://blog.ziffdavis.com/seltzer>  

Copyright (c) 2006 Ziff Davis Media Inc. All Rights Reserved. 

 
___________________________________________
Grant Hogarth 
Equis International - A Reuters Company
ghogarth at Equis.com <mailto:ghogarth at Equis.com>  /
Grant.Hogarth at Reuters.com <mailto:Grant.Hogarth at Reuters.com>  
Direct: (+1) 801.270.3180   Main Fax: 801.265.3999
URL: www.equis.com <http://www.equis.com/>   TZ: Mountain (GMT -7)