CVE-2002-0694
Summary
| CVE | CVE-2002-0694 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2002-10-10 04:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka "Code Execution via Compiled HTML Help File." |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Microsoft | Windows 2000 | All | All | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp1 | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp2 | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp3 | All | All |
| Operating System | Microsoft | Windows 2000 Terminal Services | All | All | All | All |
| Operating System | Microsoft | Windows 2000 Terminal Services | All | sp1 | All | All |
| Operating System | Microsoft | Windows 2000 Terminal Services | All | sp2 | All | All |
| Operating System | Microsoft | Windows 2000 Terminal Services | All | sp3 | All | All |
| Operating System | Microsoft | Windows 98 | All | gold | All | All |
| Operating System | Microsoft | Windows 98se | All | All | All | All |
| Operating System | Microsoft | Windows Me | All | All | All | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | workstation | All |
| Operating System | Microsoft | Windows Xp | All | All | home | All |
| Operating System | Microsoft | Windows Xp | All | gold | professional | All |
| Operating System | Microsoft | Windows Xp | All | sp1 | home | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Microsoft Security Bulletin MS02-055 - Critical | Microsoft Docs | af854a3a-2127-422b-91ae-364da2661108 | docs.microsoft.com | |
| ISS X-Force Database: win-chm-code-execution (10254): Windows compiled HTML Help (.chm) files could be used to execute code | af854a3a-2127-422b-91ae-364da2661108 | www.iss.net | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.