PT-2004-2232 · Microsoft · Winhlp32.Exe+4

Flashsky + 2 · Published 2004-12-31 · Updated 2019-04-30 · CVE-2004-1306

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Windows NT, Windows 2000 through SP4, Windows XP through SP2, Windows 2003

Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted .hlp file. This issue is related to the winhlp32.exe component.

Recommendations: For Windows NT, consider applying security patches or updates to address the issue. For Windows 2000 through SP4, apply the available security patch to fix the problem. For Windows XP through SP2, update to a newer service pack or apply a security patch. For Windows 2003, apply a security patch or update to resolve the issue. As a temporary workaround, consider restricting access to .hlp files or disabling the winhlp32.exe component until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2004-1306

Affected Products

Windows 2000

Windows 2003

Windows Nt

Windows Xp

Winhlp32.Exe

References · 6

• 🔥 http://xfocus.net/flashsky/icoExp · Exploit
• 🔥 https://exploit-db.com/exploits/25049 · Exploit
• 🔥 http://securityfocus.com/bid/12092 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1306 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18678 · Note
• http://marc.info/?l=bugtraq&m=110383690219440&w=2 · Note