CVE-2004-1306: Buffer Overflow
Published Dec 31, 2004
·Updated
Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
Affected Software
58 affected components
Microsoft Windows NT=4.0-sp5
Microsoft Windows 2003 Server=web-sp1_beta_1
Microsoft Windows XP=sp1
Microsoft Windows NT=4.0-sp3
Microsoft Windows 2003 Server=web
Microsoft Windows 2003 Server=enterprise
Microsoft Windows NT=4.0-sp6a
Microsoft Windows 2003 Server=enterprise_64-bit
Microsoft Windows 2003 Server=enterprise-sp1_beta_1
Microsoft Windows XP=gold
Microsoft Windows 2000
Microsoft Windows NT=4.0-sp6
Microsoft Windows XP
Microsoft Windows NT=4.0
Microsoft Windows NT=4.0-sp1
Microsoft Windows NT=4.0-sp3
Microsoft Windows 2000=sp4
Microsoft Windows XP=sp2
Microsoft Windows 2003 Server=datacenter_64-bit-sp1_beta_1
Microsoft Windows XP
Microsoft Windows NT=4.0-sp6
Microsoft Windows NT=4.0-sp4
Microsoft Windows XP=sp1
Microsoft Windows NT=4.0-sp5
Microsoft Windows 2000=sp2
Microsoft Windows 2003 Server=standard-sp1_beta_1
Microsoft Windows NT=4.0-sp6
Microsoft Windows NT=4.0
Microsoft Windows NT=4.0-sp4
Microsoft Windows NT=4.0-sp2
Microsoft Windows 2003 Server=r2
Microsoft Windows NT=4.0-sp6a
Microsoft Windows NT=4.0
Microsoft Windows NT=4.0-sp6a
Microsoft Windows NT=4.0-sp4
Microsoft Windows 2003 Server=r2-sp1_beta_1
Microsoft Windows NT=4.0-sp2
Microsoft Windows NT=4.0-sp1
Microsoft Windows 2000=sp1
Microsoft Windows NT=4.0-sp4
Microsoft Windows NT=4.0-sp6
Microsoft Windows XP=sp2
Microsoft Windows XP
Microsoft Windows NT=4.0-sp3
Microsoft Windows NT=4.0-sp1
Microsoft Windows NT=4.0-sp2
Microsoft Windows NT=4.0-sp5
Microsoft Windows NT=4.0-sp1
Microsoft Windows XP=sp1
Microsoft Windows 2003 Server=standard
Microsoft Windows NT=4.0
Microsoft Windows NT=4.0-sp6a
Microsoft Windows NT=4.0-sp3
Microsoft Windows 2003 Server=enterprise_64-bit-sp1_beta_1
Microsoft Windows 2003 Server=r2
Microsoft Windows NT=4.0-sp5
Microsoft Windows NT=4.0-sp2
Microsoft Windows 2000=sp3
Event History
Dec 31, 2004
CVE Published
05:00 AM
Jan 19, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1306?
CVE-2004-1306 is classified as critical due to the potential for remote code execution.
2
How do I fix CVE-2004-1306?
To remediate CVE-2004-1306, users should apply the latest patches provided by Microsoft for their affected systems.
3
Which systems are vulnerable to CVE-2004-1306?
Vulnerable systems include Windows NT, Windows 2000, Windows XP up to SP2, and Windows 2003.
4
What are the risks associated with CVE-2004-1306?
The risks involve attackers being able to execute arbitrary code on the affected systems if a malicious .hlp file is opened.
5
Can CVE-2004-1306 be exploited remotely?
Yes, CVE-2004-1306 can be exploited remotely by a user opening a maliciously crafted .hlp file.