National Cyber-Alert System

Vulnerability Summary for CVE-2004-0201

Overview

Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA04-196A

Name: TA04-196A

Type: Advisory; Patch Information

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA04-196A.html

US-CERT Vulnerability Note: VU#920060

Name: VU#920060

Type: Advisory; Patch Information

Hyperlink:http://www.kb.cert.org/vuls/id/920060

External Source: MS

Name: MS04-023

Type: Advisory; Patch Information

Hyperlink:http://www.microsoft.com/technet/security/bulletin/MS04-023.mspx

External Source: XF

Name: win-htmlhelp-execute-code(16586)

Type: Advisory

Hyperlink:http://xforce.iss.net/xforce/xfdb/16586

External Source: FULLDISC

Name: 20040714 HtmlHelp - .CHM File Heap Overflow

Hyperlink:http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023919.html

US Government Resource: oval:org.mitre.oval:def:3179

Name: oval:org.mitre.oval:def:3179

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:3179

US Government Resource: oval:org.mitre.oval:def:2155

Name: oval:org.mitre.oval:def:2155

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2155

US Government Resource: oval:org.mitre.oval:def:1530

Name: oval:org.mitre.oval:def:1530

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1530

US Government Resource: oval:org.mitre.oval:def:1503

Name: oval:org.mitre.oval:def:1503

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1503