|
Microsoft Windows "itss.dll" Heap Corruption Vulnerability
|
|
Secunia Advisory:
|
SA20061
|
|
|
Release Date:
|
2006-05-10
|
|
Last Update:
|
2006-05-11
|
|
Popularity:
|
15,130 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| OS: | Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-2297
|
|
Description:
Rubén Santamarta has discovered a vulnerability in Microsoft Windows, which potentially can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the Infotech Storage System Library (itss.dll) when reading a ".CHM" file. This can be exploited to cause heap corruption and may allow arbitrary code execution via a specially crafted ".CHM" file.
Successful exploitation requires that the user is e.g. tricked in opening or decompiling a malicious ".CHM" file using "hh.exe".
The vulnerability has been confirmed in Windows XP SP2 (fully patched) and also reported in Windows 2000 SP4. Other versions may also be affected.
NOTE: The CHM file format should be considered insecure and treated similar to an executable file. However, this vulnerability is triggered even when the user decompiles the file without opening it.
Solution:
The vulnerability will reportedly be fixed in the next Service Pack.
Do not open or decompile untrusted ".CHM" files.
Provided and/or discovered by:
Rubén Santamarta
Changelog:
2006-05-11: Added CVE reference.
Original Advisory:
http://reversemode.com/index.php?opti...&task=view&id=11&Itemid=1
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
