PowerCHM Stack-based Buffer Overflow 1. General Information PowerCHM is a tool that can create CHM files from Html Files, Text Files, Microsoft Word Documents and Adobe Acrobat Document. In March 2009, Bkis has just detected a vulnerability in the software, related to the processing of PowerCHM project files with extension “.HHP”. Hackers can exploit this flaw to execute any program, install viruses, steal private information, and even take control of users’ systems. We sent the report to the vendor. Details : http://security.bkis.vn/?p=365 SVRT Advisory : Bkis-05-2009 Initial vendor notification : 03/14/2009 Release Date : 03/26/2009 Update Date : 03/26/2009 Discovered by : Le Duc Anh, Bkis Attack Type : Buffer Overflow Security Rating : Critical Impact : Code Execution Affected Software : PowerCHM 5.7 (Prior versions may be also affected) 2. Technical Description The vulnerability exists in the way that PowerCHM processes CHM project files. When opening an “HHP” file with an overly long text field such as [WINDOWS], [FILES]. it will lead to a critical stack-based overflow. Technically, it’s very easy for hackers to exploit this flaw. A hacker might craft an “HHP” file with malicious code embedded and trick users into opening it. If successful, the hacker might execute arbitrary code on the affected application. 3. Solution Rating this vulnerability high severity and due to the fact that the manufacturer hasn’t released any official patch for PowerCHM, Bkis recommends that users be cautious with “HHP” files from untrustworthy sources until the vendor release the patch. Bkis (www.bkis.vn)