Eduardo Prado has discovered a vulnerability in Microsoft Windows, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to the "HtmlHelpA()" function in hhctrl.ocx opening CHM files placed in the current directory if a relative path is passed as argument. This can be exploited to execute arbitrary JavaScript code in a local security context by e.g. tricking a user into opening a text file (.txt) placed in the same directory as a specially crafted notepad.chm file, which is opened by notepad.exe when pressing the "F1" key inside the document.

Successful exploitation allows execution of arbitrary commands, but additionally requires that the user is tricked into clicking a topic in the malicious help file when the files are located on a network share.

The vulnerability is confirmed on fully patched versions of Windows XP SP3 and Windows Server 2003 SP2 and also reported in Windows 2000 SP4.

Solution
Avoid pressing F1 inside documents or images placed in untrusted directories.

Provided and/or discovered by
Eduardo Prado, Secumania Security Group.

Changelog
Further details available in Customer Area

Original Advisory
http://secumania.net/index.php?option=com_content&task=view&id=37

Deep Links
Links available in Customer Area