Pierluigi Paganini September 27, 2016

Microsoft encourages Windows users to remove the Windows Journal application by following the steps found in Microsoft update KB3161102.

Microsoft has removed the Windows Journal application from its OSs due to the presence of multiple security flaws that can be exploited by hackers through specially crafted Journal files (.jnt) which are used to store notes and drawings created with the app.

The presence of the flaws affecting Windows Journal is known since a long ago, bug hunters have discovered several denial-of-service (DoS) and remote code execution flaws in the application.

In the last months, Microsoft solved two memory corruption flaws, the CVE-2016-0182 reported by the researchers Jason Kratzer and Bingchang Liu, and the CVE-2016-0038 discovered by Rohit Mothe.

In August, the security researcher Honggang Ren from the security firm Fortinet identifies a heap overflow that could be exploited by attackers to crash the application. Fortinet published a blog post last week detailing the vulnerability.

Microsoft promptly decided to remove Windows Journal through the security update KB3161102.

Microsoft suggests its customers the migration to OneNote, anyway, users who need to use Windows Journal can decide to install it separately after they apply the update KB3161102. Windows will show them a security alert whenever they attempt to open Journal Note (JNT) or Journal Template (JTP) files.

“Last month, Fortinet researcher Honggang Ren discovered a heap overflow vulnerability in Windows Journal and reported it to Microsoft. This month, Microsoft released update KB3161102 and removed the Journal component from all versions of Windows because the file format used by Journal has been demonstrated to be susceptible to a number of security exploits. Microsoft recommends that all users install this update immediately. On the Microsoft Acknowledgments web page, Microsoft labeled the title of this vulnerability as “Defense-in-depth”.” reads a blog post published by Fortinet.

“Windows Journal is a note-taking application that was first introduced in Windows XP Tablet PC Edition. It’s currently a component of all supported client versions of Windows through Windows 10 Version 1511. The file format that’s used by Windows Journal (Journal Note File, or JNT) has been demonstrated to be susceptible to many security exploits. Therefore, Windows Journal will be removed from all versions of Microsoft Windows soon. ” Microsoft explained in the security update.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Windows Journal, Hacking)