PT-2007-1898 · Microsoft · Help Workshop

Porkythepig · Published 2007-01-23 · Updated 2018-10-16 · CVE-2007-0427

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Help Workshop version 4.03.0002

Description The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved through a help project (.HPJ) file with a long HLP field in the OPTIONS section.

Recommendations For Microsoft Help Workshop version 4.03.0002, consider avoiding the use of .HPJ files with long HLP fields in the OPTIONS section until a fix is available. As a temporary workaround, restrict the handling of .HPJ files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0427

Affected Products

Help Workshop

References · 9

• 🔥 http://anspi.pl/~porkythepig/visualization/hpj-x01.cpp · Exploit
• 🔥 https://exploit-db.com/exploits/3159 · Exploit
• 🔥 https://exploit-db.com/exploits/3149 · Exploit
• 🔥 http://securityfocus.com/bid/22135 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0427 · Security Note
• http://securityfocus.com/archive/1/457436/100/0/threaded · Note
• http://secunia.com/advisories/23862 · Note
• http://osvdb.org/31899 · Note
• http://securityreason.com/securityalert/2177 · Note