Description
Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow
exploit/windows/fileformat/hhw_hhp_contentfile_bof
-
HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow
exploit/windows/fileformat/hhw_hhp_compiledfile_bof
Exploit-DB 8
- Microsoft HTML Help Workshop 4.74 - '.hhp' Cotent Buffer Overflow (Metasploit) (2) EDB-16648 · local · Sep 25, 2010 · verified
- Microsoft HTML Help Workshop 4.74 - '.hhp' compiled Buffer Overflow (Metasploit) (4) EDB-16683 · local · Sep 25, 2010 · verified
- Microsoft HTML Help Workshop 4.74 - '.hhp' Local Buffer Overflow (1) EDB-10321 · local · Dec 5, 2009 · verified
- Microsoft HTML Workshop 4.74 - Universal Buffer Overflow EDB-7727 · local · Jan 12, 2009 · verified
- Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (3) EDB-1495 · local · Feb 14, 2006 · verified
- Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (2) EDB-1490 · local · Feb 11, 2006 · verified
- Microsoft HTML Help Workshop - '.hhp' Denial of Service EDB-1488 · dos · Feb 10, 2006 · verified
- Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (1) EDB-1470 · local · Feb 6, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 18740 third-party-advisory
- 22941 vdb-entry
- 1015585 vdb-entry
- mshtmlhelp-workshop-hhp-bo(24481) vdb-entry
- http://users.pandora.be/bratax/advisories/b008.html
- VU#124460 third-party-advisory
- ADV-2006-0446 vdb-entry