CVE-2002-0693 Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allow...
HighCVSS 7.5
EPSS 31.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2000 terminal services | All versions | No fix listed |
| Microsoft windows 98 | All versions | No fix listed |
| Microsoft windows 98se | All versions | No fix listed |
| Microsoft windows me | All versions | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows nt | = 4.0-sp1 | No fix listed |
| Microsoft windows nt | = 4.0-sp2 | No fix listed |
| Microsoft windows nt | = 4.0-sp3 | No fix listed |
| Microsoft windows nt | = 4.0-sp4 | No fix listed |
| Microsoft windows nt | = 4.0-sp5 | No fix listed |
| Microsoft windows nt | = 4.0-sp6 | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20021003 Buffer Overflow in IE/Outlook HTML Help mailing-list
- 20021009 Thor Larholm security advisory TL#004 mailing-list
- 20021010 prover of concept code of windows help overflow mailing-list
- win-html-help-bo(10253) vdb-entry vendor-advisory
- 5874 vdb-entry
- MS02-055 vendor-advisory
- oval:org.mitre.oval:def:374 signature vdb-entry