HTTP: Microsoft Compiled Help (.chm) File Download
This signature detects an attempt to download a Microsoft Compiled Help (.chm) file. Opening a malicious .chm file can allow for arbitrary code execution, leading to system comprimise. This vulnerability is present in Microsoft Windows 2000 and Microsoft Windows XP. Please note that there are legitimate uses for this filetype. Therefore, not all instances of this signature are actual attacks.
Extended Description
Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.
Affected Products
Microsoft windows_98
References
BugTraq: 10705
CVE: CVE-2004-0201
URL: http://www.microsoft.com/technet/security/bulletin/MS04-023.mspx http://support.microsoft.com/?kbid=291369
Short Name
HTTP:EXT:DOT-CHM
Severity
Info
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
(.chm) CVE-2004-0201 Compiled Download File Help Microsoft bid:10705
Release Date
07/14/2004
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
False Positive
Rarely
Vendors
Microsoft
Avaya
CVSS Score
10.0