CVE-2017-2819 Hangul Word Processor Buffer Overflow Vulnerability

Hangul (also known as Hangul Word Processor or HWP) is a proprietary word processing application from Hancom Inc.. Hangul has specialized support for Korean language.

Hangul Word Processor is prone to a heap-based buffer overflow vulnerability which can exploited using a specially crafted document stream which can cause an integer underflow.

Affected Version:
Hangul Word Processor component (version 9.6.1.4350) of Hancom Thinkfree Office NEO 9.6.1.4902.

QID Detection Logic (Authenticated):
The QID checks if vulnerable version of Hangul Word Processor is installed on the target by looking at the file version of Hword.exe. The install location is determined with the of the help of the registry key "HKLM\SOFTWARE\Wow6432Node\HNC\Shared\HncUpdate\HncUtils_NEO" value "Path". The file is located in <InstallLocation>\HOffice96\Bin\Hword.exe.

Successful exploitation of the vulnerability will lead to remote code execution.

Customers are advised to download the latest version from vendor website.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Hangul Word Processor