Microsoft Investigates HTML Help Flaw Warning

Microsofts security response team is investigating reports of a remotely exploitable buffer overflow in HTML Help Workshop, the standard help system for the Windows platform.

The software vendors investigation follows the public release of a proof-of-concept exploit for the flaw, which is caused by a boundary error within the handling of a ".hhp" file.

Security alerts aggregator Secunia, based in Copenhagen, Denmark, rated the issue as "moderately critical" and warned that a successful attack could cause harmful code to be executed when a malicious .hhp file is opened.

The vulnerable Microsoft HTML Help Workshop is part of the Microsoft HTML Help 1.4 SDK (software development kit) and is used to compress HTML, graphics files and other types of files into a relatively small compiled help (.chm) file.

According to a published alert, an unchecked buffer in the way HTML Help Workshop processes .hhp files allows a remote user to take control of a target machine and execute arbitrary code with the privileges of the user.

Resource Library:

The buffer overflow occurs when a long string is supplied as a contents file.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

The vulnerability has been confirmed in HTML Help Workstation version 4.74.8702.0. Other versions may also be affected, Secunia warned.

A spokesperson for Microsoft, based in Redmond, Wash., told eWEEK that the company is not aware of any attacks attempting to use the reported vulnerability.

She said the initial investigation has revealed that customers who have not installed the HTML Help SDK on their systems are not affected by the public report.

Microsoft joins the chorus warning about the "Blackworm" D-Day. Click here to read more.

"By default, no other Microsoft applications or operating systems have the ability to open .hhp files," the spokesperson added. "Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include issuing a security advisory or providing a security update through our monthly release process, depending on customer needs."

The Microsoft HTML Help SDK is used to create online help for a software application or to create content for a multimedia title or Web site. Developers can use the HTML Help API to program a host application or hook up context-sensitive help to an application.

As an information delivery system, HTML Help is suited for a wide range of additional applications, including training guides, interactive books and electronic newsletters.

Earlier this year, Microsoft released a security bulletin with patches for a critical hole in the HTML Help ActiveX control in Windows. That bug could have allowed an attacker to "take complete control of an affected system" to load, manipulate or delete data.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.