DOCUMENT:Q231605 TITLE :Malformed Help File Causes Help Utility to Stop Responding PRODUCT :Windows NT PROD/VER:4.0 OPER/SYS:WINDOWS NT KEYWORD :kbbug4.00 kbfix4.00 ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4 ------------------------------------------------------------------------------- SYMPTOMS ======== A specially-malformed Microsoft Help file may be used to exploit a security vulnerability on a Windows NT-based computer. When a user activates the Windows Help file tool (for example, by pressing the F1 key) this vulnerability may be used to run a program and may cause the Help file tool to stop responding (hang). CAUSE ===== The Help tool parses and displays Help information for programs. The Help information is contained in several file types that are generated by the Microsoft Help Compiler program and are stored (by default) in the %SystemRoot%\Help folder. Users have both Read and Write permissions to this folder by default. An unchecked buffer exists in the Help utility, and a Help file that has been carefully modified could be used to run a program on the local computer using a buffer overrun technique. Because the Help Compiler program's output files do not generate the specific malformation at issue here, this vulnerability could not be accidentally exploited. RESOLUTION ========== A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Windows NT 4.0 service pack that contains this fix. To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web: http://www.microsoft.com/support/supportnet/overview/overview.asp The English version of this fix should have the following file attributes or later: Date Time Size File name Platform ------------------------------------------------------------- 05/03/99 08:33p 311,056 Winhlp32.exe x86 05/03/99 08:31p 580,368 Winhlp32.exe Alpha This hotfix has been posted to the following Internet location as Winhlp-i.exe (x86) and Winhlp-a.exe (Alpha): ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/ hotfixes-postSP5/winhlp32-fix/ NOTE: This hotfix can be applied to computers running Windows NT 4.0 Service Pack 4 or Windows NT 4.0 Service Pack 5. NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, and if it is determined that you only require the fix you requested, no fee will be charged. However, if you request additional technical support, and if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support, you may be charged a non-refundable fee. For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base: Q154871 Determining If You Are Eligible for No-Charge Technical Support STATUS ====== Microsoft has confirmed this to be a problem in Windows NT 4.0. MORE INFORMATION ================ Computers primarily at risk from this vulnerability are workstations, terminal servers, and other computers that allow users to log on interactively and add or modify Help files. Servers generally do not allow normal users to interactively log on. Note that this vulnerability would affect only the local computer; there is no capability to directly attack a remote computer by means of this vulnerability. For related information on this problem, please visit the Web site at: http://www.microsoft.com/security/bulletins/MS99-015.asp For additional security-related information about Microsoft products, please visit the Web site at: http://www.microsoft.com/security/ Additional query words: ============================================================================ THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.