Secunia

Microsoft has issued patches for Microsoft Windows to fix a vulnerability in the Help and Support Center.

The vulnerability is caused due to a boundary error in the file associated with the HCP protocol. This can be exploited via the HCP protocol on Microsoft Windows XP and Microsoft Windows 2003 through Internet Explorer or Outlook to cause a buffer overflow.

Other versions of Microsoft Windows do not support the HCP protocol and there are therefore no known attack vector. Microsoft states that the vulnerability is not believed to be exploitable on those versions, even though the vulnerable code is included.

Solution
Microsoft has issued patches:
Further details available in Customer Area

Provided and/or discovered by
David Litchfield, Next Generation Security Software.

Changelog
Further details available in Customer Area

Original Advisory
Buffer Overrun in Windows Help and Support Center Could Lead to System Compromise
http://www.microsoft.com/technet/security/bulletin/MS03-044.asp

Microsoft PCHealth Privilege Escalation:
http://www.nextgenss.com/advisories/ms-pchealth.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area