HTTP: Microsoft Windows CHM File Magic Detected
This signature detects an attempt to download a Microsoft Compiled Help (.chm) file. Opening a malicious .chm file can allow for arbitrary code execution, leading to system comprimise.
Extended Description
Integer overflow in Microsoft Windows 98, 2000, XP SP2 and earlier, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file with a large size field that triggers a heap-based buffer overflow, as demonstrated using a "ms-its:" URL in Internet Explorer.
Affected Products
Microsoft windows_98
Short Name
HTTP:STC:DL:WIN-CHM-DETECTION
Severity
Minor
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
CHM CVE-2005-1208 Detected File Magic Microsoft Windows bid:13953
Release Date
06/09/2015
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
False Positive
Unknown
Vendors
Microsoft
CVSS Score
10.0