Right after Microsoft’s April Patch Tuesday, several security Web sites reported four new vulnerabilities, only to have Microsoft dispute that none of the three alleged to affect Word 2007 "demonstrate any vulnerability in Word 2007 or any Office 2007 products." The software giant is also disappointed that it was not notified of the alleged problems before they were publicly disclosed. Two of alleged Word 2007 problems are said to cause CPU usage to surge to 100%, creating a denial-of-service condition, according to a posting on the Security Vulnerabilities Web site. The third vulnerability Word 2007 could supposedly allow remote code execution.
The fourth alleged vulnerability, which concerns the ".hlp" extension for Windows help files, could lead to a heap overflow condition, the posting said. Microsoft acknowledged the problem, saying that .hlp is an "unsafe file format" and is executable, allowing it to run code when opened. The company said users should be cautious about opening unsolicited e-mail attachments with .hlp files. As always, Microsoft has warned that people should not open files sent from unknown sources.
News source: InfoWorld
The fourth alleged vulnerability, which concerns the ".hlp" extension for Windows help files, could lead to a heap overflow condition, the posting said. Microsoft acknowledged the problem, saying that .hlp is an "unsafe file format" and is executable, allowing it to run code when opened. The company said users should be cautious about opening unsolicited e-mail attachments with .hlp files. As always, Microsoft has warned that people should not open files sent from unknown sources.
News source: InfoWorld
Why in the hell would they design a help format that can execute code? Stupid.
By executable, I'm guessing they're referring to those good old days of Windows 95 help files with shell links and embedded OLE objects.
Last edited by Z3r0 on 12 Apr 2007 - 07:58
Thank you so much for providing this.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.