Microsoft Windows Help File Relative Path Remote Command Execution Vulnerability

Bugtraq ID:	38661
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 06 2010 12:00AM
Updated:	Mar 06 2010 12:00AM
Credit:	edu of Secumania Security Group
Vulnerable:	Microsoft Windows XP Professional x64 Edition SP3 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional
Not Vulnerable:

Microsoft Windows Help File Relative Path Remote Command Execution Vulnerability

Microsoft Windows is prone to a remote command-execution vulnerability because it opens help files from unsafe locations.

An attacker could exploit this issue by enticing a victim to load help files when working in a directory containing crafted '.chm' files.

Windows 2000 and XP are vulnerable; other versions may also be affected.

Microsoft Windows Help File Relative Path Remote Command Execution Vulnerability

An attacker must entice an unsuspecting victim to open a malicious file.

The following example is available:

• /data/vulnerabilities/exploits/38661.zip

Microsoft Windows Help File Relative Path Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Help File Relative Path Remote Command Execution Vulnerability

References:

• First Remote Code Execution Vulnerability affecting Microsoft Notepad (edu)
  
• Microsoft Windows Homepage (Microsoft )
  
• Remote Code Execution Vulnerability on Microsoft Notepad (Advisory+PoC) (edu)