[Bkis-05-2009] PowerCHM Stack-based Buffer Overflow
PowerCHM Stack-based Buffer Overflow
1. General Information
PowerCHM is a tool that can create CHM files from Html Files, Text
Files, Microsoft Word Documents and Adobe Acrobat Document.
In March 2009, Bkis has just detected a vulnerability in the software,
related to the processing of PowerCHM project files with extension
“.HHP”. Hackers can exploit this flaw to execute any program, install
viruses, steal private information, and even take control of users’
systems. We sent the report to the vendor.
Details : http://security.bkis.vn/?p=365
SVRT Advisory : Bkis-05-2009
Initial vendor notification : 03/14/2009
Release Date : 03/26/2009
Update Date : 03/26/2009
Discovered by : Le Duc Anh, Bkis
Attack Type : Buffer Overflow
Security Rating : Critical
Impact : Code Execution
Affected Software : PowerCHM 5.7 (Prior versions may be also affected)
2. Technical Description
The vulnerability exists in the way that PowerCHM processes CHM project
files. When opening an “HHP” file with an overly long text field such as
[WINDOWS], [FILES]. it will lead to a critical stack-based overflow.
Technically, it’s very easy for hackers to exploit this flaw. A hacker
might craft an “HHP” file with malicious code embedded and trick users
into opening it. If successful, the hacker might execute arbitrary code
on the affected application.
3. Solution
Rating this vulnerability high severity and due to the fact that the
manufacturer hasn’t released any official patch for PowerCHM, Bkis
recommends that users be cautious with “HHP” files from untrustworthy
sources until the vendor release the patch.
Bkis (www.bkis.vn)