CVE-2004-1306 Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
MediumCVSS 5.1
EPSS 21.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = datacenter_64-bit-sp1_beta_1 | No fix listed |
| Microsoft windows 2003 server | = enterprise | No fix listed |
| Microsoft windows 2003 server | = enterprise-sp1_beta_1 | No fix listed |
| Microsoft windows 2003 server | = enterprise_64-bit | No fix listed |
| Microsoft windows 2003 server | = enterprise_64-bit-sp1_beta_1 | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 2003 server | = r2-sp1_beta_1 | No fix listed |
| Microsoft windows 2003 server | = standard | No fix listed |
| Microsoft windows 2003 server | = standard-sp1_beta_1 | No fix listed |
| Microsoft windows 2003 server | = web | No fix listed |
| Microsoft windows 2003 server | = web-sp1_beta_1 | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows nt | = 4.0-sp1 | No fix listed |
| Microsoft windows nt | = 4.0-sp2 | No fix listed |
| Microsoft windows nt | = 4.0-sp3 | No fix listed |
| Microsoft windows nt | = 4.0-sp4 | No fix listed |
| Microsoft windows nt | = 4.0-sp5 | No fix listed |
| Microsoft windows nt | = 4.0-sp6 | No fix listed |
| Microsoft windows nt | = 4.0-sp6a | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20041223 Microsoft Windows winhlp32.exe Heap Overflow Vulnerability mailing-list
- 12092 exploit vdb-entry
- www.xfocus.net exploit
- win-winhlp32-bo(18678) vdb-entry