vulnerability announce 9512

Windows: code execution via Notepad

Synthesis of the vulnerability

An attacker can invite the victim to open a text file with Notepad, and then to press the F1 key, in order to execute code on his computer.

Severity: 2/4. Creation date: 12/03/2010.

Description of the vulnerability

When the user presses the F1 key from Notepad, the help is launched. If a file named "notepad.chm" exists in the directory containing the text file, and if the user presses F1, the help comes from this notepad.chm file. Moreover, a ".chm" help file can contain commands to be executed. An attacker can therefore create a ZIP archive containing a text file and notepad.chm, or upload both files to a network share. The attacker can then invite the victim to open the text file with Notepad, and then to press the F1 key, in order to execute code on his computer.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: Windows: code execution via Notepad. Keywords: Notepad Windows ZIP code execution. Identifiers: BID-38661, VIGILANCE-VUL-9512.

Information sources

Publications and announces Source example: First Remote Code Execution Vulnerability affecting Microsoft Notepad

Solutions for this vulnerability

Patch or workaround

Supplements

Attack Exploit 0day or proof of concept

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Technology watch team on vulnerabilities