Ziff Davis Internet
News & Resources for the IT Reseller
NewsReviewsTech AnalysisCommentarySecurityLinux/Unix
My Account |  

Microsoft Investigates HTML Help Flaw Warning
By Ryan Naraine

Microsoft’s security response team is investigating reports of a remotely exploitable buffer overflow in HTML Help Workshop, the standard help system for the Windows platform.


The software vendor’s investigation follows the public release of a proof-of-concept exploit for the flaw, which is caused by a boundary error within the handling of a “.hhp” file.

Security alerts aggregator Secunia, based in Copenhagen, Denmark, rated the issue as “moderately critical” and warned that a successful attack could cause harmful code to be executed when a malicious .hhp file is opened.

The vulnerable Microsoft HTML Help Workshop is part of the Microsoft HTML Help 1.4 SDK (software development kit) and is used to compress HTML, graphics files and other types of files into a relatively small compiled help (.chm) file.

According to a published alert, an unchecked buffer in the way HTML Help Workshop processes .hhp files allows a remote user to take control of a target machine and execute arbitrary code with the privileges of the user.

The buffer overflow occurs when a long string is supplied as a contents file.

PointerFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internet’s Security IT Hub.

The vulnerability has been confirmed in HTML Help Workstation version 4.74.8702.0. Other versions may also be affected, Secunia warned.

eWEEK.com Special Report: Application Security

A spokesperson for Microsoft, based in Redmond, Wash., told eWEEK that the company is not aware of any attacks attempting to use the reported vulnerability.

She said the initial investigation has revealed that customers who have not installed the HTML Help SDK on their systems are not affected by the public report.

PointerMicrosoft joins the chorus warning about the “Blackworm” D-Day. Click here to read more.

“By default, no other Microsoft applications or operating systems have the ability to open .hhp files,” the spokesperson added. “Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include issuing a security advisory or providing a security update through our monthly release process, depending on customer needs.”

eWEEK Special Report: Securing Windows

The Microsoft HTML Help SDK is used to create online help for a software application or to create content for a multimedia title or Web site. Developers can use the HTML Help API to program a host application or hook up context-sensitive help to an application.

As an information delivery system, HTML Help is suited for a wide range of additional applications, including training guides, interactive books and electronic newsletters.

Earlier this year, Microsoft released a security bulletin with patches for a critical hole in the HTML Help ActiveX control in Windows. That bug could have allowed an attacker to “take complete control of an affected system” to load, manipulate or delete data.

PointerCheck out eWEEK.com’s Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.



Free Hands-On Training Lab
Find out how key features of SBS 2003 can help you open up a new line of revenue. Register now >>

SBS 2003 Sales Reference Card
This handy reference card contains features at a glance, sales objection handling, pricing guidelines & more. Get it now >>

Microsoft Empower for ISVs rewards your big idea with big benefits and support.
Access key development tools at a low cost to help you develop that idea into an innovative application. Learn more >>

Autotask makes your IT business run. Better!
  • Manage your entire business from a single integrated system accessed over the web
  • Track and control service tickets, and efficiently dispatch field service techs
  • Monitor and analyze project profitability by project, customer and type
  • Bill by fixed price, time & materials, block hours or retainers
  • Set up workflow rules and automated notifications
  • Nothing to install. Easy to use. Affordable.
Click here ONLY if you want a personalized demo via the web
(North America only, please)

Attention Microsoft Solution Providers!

Want to gain a competitive edge? Try Microsoft Watch – FREE!

Each week you receive:
  • Microsoft News and Insider Information
  • Expert Analysis
  • Code Names of Upcoming MS Products
  • Year-Ahead Calendar, updated monthly

    Click Here to sign up now for your FREE 14 Day Trial to Microsoft Watch.
  • Add up to $1,200 of value with the new BONUS PACKS.
  • High Performance Storage That Blows Away Competitors.
  • Adaptec Adaptec SATA II RAID Outperforms LSI, Promise, 3Ware
  • Create, manage, and archive all content with EMC
  • Go Pro.Introducing Intel® vPro™ technology.
  • Free on-line courses at Data Center University
  • The Power to Build Great Devices – Windows Embedded
  • Windows gets top EAL 4+ security rating from SAIC.
  • Get the Facts on Linux and Windows Server.
  • Get a FREE Forrester white paper courtesy of Oracle.
  • Free Whitepaper: The future of Identity Management.

    •Catalog Publishing
    •Dealer Management
    •Order Configuration
    •Price Management
    •Sales Management

    View All >

    Search the jobs you want & get the info you need – post your resume here today!

    Powered by Dice
    White Boxes
    MS vs. IBM
    Linux in the Channel
    Stay in the Zone
    Put The Channel Insider on your desktop.
    Subscribe to The Channel Insider: Channel News, Reviews, Resources and more.

    Make your selections below:

    Contract Watch

    The Channel Insider Update

    Preferred e-mail format:

    Enter your e-mail:

    view all newsletters >>
    Channel Insider Quick Links
    Ziff Davis Footer Logo