June 2006

ID: 00435
Ref: 422/2006
Date: 23 June 2006:13:23:15
Version: 1

---

Title: US-CERT - Microsoft Hyperlink Object Library stack buffer overflow
Abstract: The Hyperlink Object Library provides interfaces for handling hyperlinks. More information is available in the Microsoft Hyperlinks Guide.
Vendors affected: US CERT
Operating systems affected: US CERT
Applications affected: US CERT

---

Title
=====

US-CERT - Microsoft Hyperlink Object Library stack buffer overflow

Detail
======

The Hyperlink Object Library provides interfaces for handling hyperlinks. More
information is available in the Microsoft Hyperlinks Guide.


- ----------------------------------------------------------------------------------

Vulnerability Note VU#394444
Microsoft Hyperlink Object Library stack buffer overflow

Overview

The Microsoft Windows system library for handling hyperlinks contains a buffer overflow.
Exploitation of this vulnerability may allow an attacker to execute arbitrary code.

I. Description

Microsoft Hyperlink Object Library (HLINK.DLL)

The Hyperlink Object Library provides interfaces for handling hyperlinks. More
information is available in the Microsoft Hyperlinks Guide.

The Problem

There is a stack-based buffer overflow in the Microsoft Hyperlink Object Library.
The overflow may be triggered by clicking a specially crafted hyperlink. Note that
any program that links to the HLINK.DLL library may be vulnerable, including
Microsoft Office applications.

Exploit code for this vulnerability is publicly available.

II. Impact

By convincing a user to access a specially crafted hyperlink, an attacker could
execute arbitrary code with the privileges of the attacked user. If the user is
logged in with administrative privileges, the attacker could take complete control
of a vulnerable system.

III. Solution

There is currently no patch or update to correct this problem. Until a solution is
available, refer to the workaround below.

Do not follow unsolicited hyperlinks

Do not click on unsolicited links received in email or embedded in Office documents.
Exploitation of this vulnerability requires a user to click a specially crafted link.
By only accessing hyperlinks from known and trusted sources, the chances of exploitation are reduced.

Systems Affected

Vendor Status Date Updated
Microsoft Corporation Vulnerable 21-Jun-2006

References

http://blogs.technet.com/msrc/archive/2006/06/20/437826.aspx
http://msdn.microsoft.com/workshop/misc/hlink/reference/ifaces/ihlink/ihlink.asp
http://msdn.microsoft.com/library/default.asp?url=/workshop/misc/hlink/overview/overview.asp

Credit

This vulnerability was reported by kcope.

This document was written by Jeff Gennari.
Other Information
Date Public 18/06/2006
Date First Published 21/06/2006 14:49:04
Date Last Updated 21/06/2006
CERT Advisory
CVE Name CVE-2006-3086
Metric 37.50
Document Revision 53