PowerCHM Stack-based Buffer Overflow

1. General Information

PowerCHM is a tool that can create CHM files from Html Files, Text 
Files, Microsoft Word Documents and Adobe Acrobat Document.

In March 2009, Bkis has just detected a vulnerability in the software, 
related to the processing of PowerCHM project files with extension 
“.HHP”. Hackers can exploit this flaw to execute any program, install 
viruses, steal private information, and even take control of users’ 
systems. We sent the report to the vendor.

Details : http://security.bkis.vn/?p=365
SVRT Advisory : Bkis-05-2009
Initial vendor notification : 03/14/2009
Release Date : 03/26/2009
Update Date : 03/26/2009
Discovered by : Le Duc Anh, Bkis
Attack Type : Buffer Overflow
Security Rating : Critical
Impact : Code Execution
Affected Software : PowerCHM 5.7 (Prior versions may be also affected)

2. Technical Description

The vulnerability exists in the way that PowerCHM processes CHM project 
files. When opening an “HHP” file with an overly long text field such as 
[WINDOWS], [FILES]. it will lead to a critical stack-based overflow.

Technically, it’s very easy for hackers to exploit this flaw. A hacker 
might craft an “HHP” file with malicious code embedded and trick users 
into opening it. If successful, the hacker might execute arbitrary code 
on the affected application.

3. Solution

Rating this vulnerability high severity and due to the fact that the 
manufacturer hasn’t released any official patch for PowerCHM, Bkis 
recommends that users be cautious with “HHP” files from untrustworthy 
sources until the vendor release the patch.

Bkis (www.bkis.vn)