<<< Date Index >>>     <<< Thread Index >>>

[Bkis-05-2009] PowerCHM Stack-based Buffer Overflow



PowerCHM Stack-based Buffer Overflow

1. General Information

PowerCHM is a tool that can create CHM files from Html Files, Text Files, Microsoft Word Documents and Adobe Acrobat Document.

In March 2009, Bkis has just detected a vulnerability in the software, related to the processing of PowerCHM project files with extension “.HHP”. Hackers can exploit this flaw to execute any program, install viruses, steal private information, and even take control of users’ systems. We sent the report to the vendor.

Details : http://security.bkis.vn/?p=365
SVRT Advisory : Bkis-05-2009
Initial vendor notification : 03/14/2009
Release Date : 03/26/2009
Update Date : 03/26/2009
Discovered by : Le Duc Anh, Bkis
Attack Type : Buffer Overflow
Security Rating : Critical
Impact : Code Execution
Affected Software : PowerCHM 5.7 (Prior versions may be also affected)

2. Technical Description

The vulnerability exists in the way that PowerCHM processes CHM project files. When opening an “HHP” file with an overly long text field such as [WINDOWS], [FILES]. it will lead to a critical stack-based overflow.

Technically, it’s very easy for hackers to exploit this flaw. A hacker might craft an “HHP” file with malicious code embedded and trick users into opening it. If successful, the hacker might execute arbitrary code on the affected application.

3. Solution

Rating this vulnerability high severity and due to the fact that the manufacturer hasn’t released any official patch for PowerCHM, Bkis recommends that users be cautious with “HHP” files from untrustworthy sources until the vendor release the patch.

Bkis (www.bkis.vn)