Printable View
Info here:
http://www.theregister.co.uk/2004/09...dows_jpeg_bug/
http://www.theinquirer.net/?article=18446
http://www.wired.com/news/infostruct...w=wn_tophead_8
Windows Updates are available to fix this problem both in the OS and all affected apps:
http://v5.windowsupdate.microsoft.co....aspx?ln=en-us
I have sp2 installed and got the update. Even though those links I read said it was not needed.
Yeah that's what my link in this post was about http://discussions.virtualdr.com/sho...186#post863186
The Windows Hotfix for this does not take the usual form, it is in two parts. The second part takes you to a webpage that downloads an ActiveX control that checks other vulnerable apps. I discovered that if you download the .NET Framework SP1 update at the same time, which requires a reboot, then if you click yes to the reboot you'll lose the webpage part of the update. And it doesn't go into the browser history either for some reason.
Here is the URL, in case anyone needs it:
GDI+ Security Update
Only use the link if you need it, as far as I'm aware you need the first part of the update to be installed first before you can use that ActiveX control.
And I, like Train, also found that despite what those articles say, Windows Update still offers the patch after Service Pack 2 is installed.
Definately do this update by its self.
Went to Windows Update and surprisingly was told the update was available to me, even though the MSKB article says WinXP SP2 without Office does not need it.
"(Important Windows XP Service Pack 2 (SP2) is not affected by this issue. Windows XP SP2 users only need to update Office (if installed). )" I do not have Office.
So, being a good MS customer I downloaded it, anyway. More concerning I got message saying (best as I can remember) that I had some graphics on my PC that could pose a problem. So I followed the instructions and seeing nothing more specific, clicked the button on http://www.microsoft.com/security/bu...jpeg_tool.mspx to scan for "Click for affected Imaging Software". After agreeing to a hold harmless paragraph, nothing happened, except that that link changed into a notice that
"This tool is designed for computers running Windows 2000 and earlier. Windows XP, Windows XP SP1, and Windows Server 2003 users may update their computers by visiting the Windows Update Web site."
Pretty circuitous.
Oh, Well. :rolleyes:
I followed WelshJim's link on a WinNT machine and clicked the [Check for Affected Imaging Software] followed by agreeing to the agreement.
Thw window changed to sayQuote:
No affected imaging software was found on this computer
Maybe I spoke too soon. There is another link (#4) below #3 which leads you to a list of software affected.
http://www.microsoft.com/technet/sec.../MS04-028.mspx
Since I have none of those I wonder why Windows Update offered the patch to me. (Actually I had seen that list earlier, and so did nothing to get the patch until Windows Update offered it.)
got this reply also
--------------------------------------------------------------------------------
No affected imaging software was found on this computer
That ActiveX control to check affected imaging software is for versions of Windows other than WinXP or Server 2003 BTW. It doesn't work at all on XP, I tried it.
Hmm from the list I can see that my hanging back with WinMe and Office2000 is now paying off. LOL
And the funny part is , a completely unpatched Office 2000 gets a clear OK. While the folks that have the Office updates get told to patch it. WIERD is right.
That's me :D
Probably less that 10 Windows Updates installed and zero Office 2000 updates installed.
No firewall, just up to date NAV 2002 and Ad-Aware.
Seems the more secure you try to be the more at risk you seem to be ?
It's more challenging to break into Fort Knox than some small country bank in the back of beyond.
There's some interesting commentary here:
http://news.bbc.co.uk/1/hi/technology/3666702.stm
And if this is anything to go by, it won't be long to wait before this one is exploited:
http://www.theinquirer.net/?article=18510
Make sure that you are patched against this vulnerability, people.
Btw is it just me or does this only work in IE a not Firefox.Quote:
The button is greyed out in FF.
It uses ActiveX to run code locally on your machine, so it requires IE.
And the first exploits are well under way, according to this:
http://www.theinquirer.net/?article=18585
WinXP users should seriously consider upgrading to SP2 IMO, enad everytone else should get patched. I think this is going to be a big one when it hits :(
For those paranoid folk there a GDI Scan tool thats been produced for scanning all your applications to check if any are vulnerable ;)
Quote:
gdiscan.exe was written for Windows 2000 and higher. It scans the drive containing the Windows %system% directory and Looks for vulnerable versions of gdiplus.dll, sxs.dll, wsxs.dll, mso.dll.
The scan starts upon execution. It will signal completion of scan in text box with "Done."
Vulnerable versions of the .dll files are listed in RED.
The path where a vulnerable .dll file is found is important. Remember that dlls are loaded in the following order (note: this is a VAST simplification):
The directory from which the application loaded.
The (application's) current directory.
Windows 95/98: The Windows system directory (default: C:\Windows\system)
Windows NT+: The 32-bit Windows system directory (default: C:\WinNT\System32)
Windows NT+: The 16-bit Windows system directory (default: C:\WinNT\System)
The Windows directory (default: C:\WinNT or C:\Windows)
The directories that are listed in the PATH environment variable
some more reading here
http://www.crn.com/showArticle.jhtml?articleID=47902683
My suspicion is that MS added the code to allow backdoors into JPEG's to satisfy the DOJ's assault on pedophiles. That is purely a guess.
Concerningmaybe this has been said already, but I am finally realizing that the above page is a diagnostic tool to tell you if you need the GDI+ security update. If Step 3 indicates no further action is needed, then so be it. If step 3 says you need the GDI+ security update, you will get instructions where to get it.Quote:
http://www.microsoft.com/security/bulletins/200409_jpeg_tool.mspx
Since Windows Update offered this website to me, I assumed it was the GDI+ security fix, itself, which it isn't.
Vernon Frazee--So what are those who are not offered the GDI+ security update (since they do not run Office components) to do about the vulnerability in IE?
Or MS Works which also does not have a patch either :rolleyes:
According to the Internet Storm Center at the SANS Institute, computers with updated versions of anti-virus software should be protected also.
Hackers Target Microsoft's JPEG Flaw
http://www.kansascity.com/mld/kansas...9784184.htm?1c
From this one, until someone else creates another exploit for the same vuln and gets it out widely before the AV vendors catch up.Quote:
Originally posted by DuaneB
According to the Internet Storm Center at the SANS Institute, computers with updated versions of anti-virus software should be protected also.
Antivirus software is a nice safety net, but it really can't be relied on as an alternative to patching.
GDI+ JPEG Vulnerability: Info/FAQ/Fix
http://discussions.virtualdr.com/sho...hreadid=173993
Vernon Frazee--Thanks for the very informative references.
I have run the gdiscan and found five "vulnerable" versions of gdiplus.dll, two of which were in Microsoft files
C:\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDIPLUS.DLL
Version: 5.1.3097.0 <-- Vulnerable version
C:\I386\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
The new version from the SDK download is
5.1.3102.1360
Has anybody here actually replaced the "vulnerable" version with the new version? Systems still work? Always nice to learn from someone else's experience.
Just had the GDI scan note vulnerabilities in Works 7 and NSW2004 as below and replaced both with the patched version and all seems to be working.
Quote:
C:\Program Files\Microsoft Works\gdiplus.dll
Version: 5.1.3079.3 <-- Vulnerable version [Works v 7]
C:\Program Files\Norton SystemWorks\Password Manager\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version [ NSW 2004]
C:\Program Files\Symantec\Web Tools\GDIPlus.dll
Version: 5.1.3097.0 <-- Vulnerable version [NSW 2004]
I ran the GDI scan from that tutorial this morning. I came up with a file at C:\WINDOWS\SYSTEM32\gdiplus.dll that I don't know what to do with. The tutorial says "that I need to visit the web site of this application and see if there is any update available." I don't know where at Microsoft I'm supposed to find an update for it (or what application it applies to).
DuaneB--It is unfortunate that there are two threads on this subject. Your last post has been anticipated in the other thread. And I see the problems you have had.
http://discussions.virtualdr.com/sho...424#post868424
As far as learning what the other non-Microsoft applications are doing about the new gdiplus.dll, you have to go to their websites and see/ask. So far I have had no response.
Thanks, Jim. I think there are actually three threads on this issue.
Since IE is a Microsoft product, I'd try their http://windowsupdate.microsoft.com site first?Quote:
Originally posted by Welshjim
Vernon Frazee--So what are those who are not offered the GDI+ security update (since they do not run Office components) to do about the vulnerability in IE?
Since MSWorks is also a Microsoft product, I'd try their http://windowsupdate.microsoft.com site.Quote:
Originally posted by 104456
Or MS Works which also does not have a patch either :rolleyes:
Yes, I have, on a new machine running Windows XP Home with SP2 applied. So far it's working fine.Quote:
Originally posted by Welshjim
Has anybody here actually replaced the "vulnerable" version with the new version? Systems still work? Always nice to learn from someone else's experience.
I'd try http://windowsupdate.microsoft.com first and see if it recommends any critical updates.Quote:
Originally posted by DuaneB
I ran the GDI scan from that tutorial this morning. I came up with a file at C:\WINDOWS\SYSTEM32\gdiplus.dll that I don't know what to do with. The tutorial says "that I need to visit the web site of this application and see if there is any update available." I don't know where at Microsoft I'm supposed to find an update for it (or what application it applies to).
Been there Vernon they dont seem to offer many updates for older versions of Works its seems like Offices lost cousin :DQuote:
Originally posted by Vernon Frazee
Since MSWorks is also a Microsoft product, I'd try their http://windowsupdate.microsoft.com site.
I ended up just replacing the file with that posted on the MS link you kindly provided.
Yes, there are. Here are links to the other two:Quote:
Originally posted by DuaneB
Thanks, Jim. I think there are actually three threads on this issue.
Security News / Warnings / Updates > GDI+ JPEG exploit worse than first thought
http://discussions.virtualdr.com/sho...hreadid=173931
Windows XP > A new Critical Update is available
http://discussions.virtualdr.com/sho...hreadid=173155
And then this one,
Security News / Warnings / Updates > Security vulnerability in Jpegs
http://discussions.virtualdr.com/sho...hreadid=173136
Nothing on this at the Windows Update site as of a few minutes ago, and still no response from providers of non-Microsoft programs.