Printable View
A Critical Update is available to fix what could potentially be a very nasty vulnerability. Despite what some of you may have read, Windows Update offers the patch even if you have SP2 installed.
This is a more complex patch than usual, please see my thread here:
http://discussions.virtualdr.com/sho...525#post863525
It's also available for Windows server 2003 BTW.
Note that the actual JPEG vulnerability does NOT effect XP SP2...
It is only the GDI+ Detection tool that is available on SP2.
EDIT: forget what i said about bugs for now, I'll keep ya updated if i find anything else.
SuperSparks--"Critical" Update or "High Priority" Update? :D :D
So many changes in XP, for no purpose that I can see. :rolleyes:
Going by the news sites, everyone is calling it Critical. I think if an exploit for this one gets written it will be at least as bad as Blaster was.
Microsoft Security Bulletin Summary for September, 2004Quote:
Critical Security Bulletins
===========================
MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow
Code Execution (833987)
- Affected Software:
- Windows XP and Windows XP Service Pack 1
- Windows XP 64-Bit Edition Service Pack 1
- Windows XP 64-Bit Edition Version 2003
- Windows Server 2003
- Windows Server 2003 64-Bit Edition
- Office 2003
- Office XP Service Pack 3
- Visio 2003 (All versions)
- Visio 2002 Service Pack 2 (All versions)
- Project 2003 (All versions)
- Project 2002 Service Pack 1 (All versions)
- Review bulletin MS04-O28 for information about
these affected operating systems and applications:
- Windows NT Workstation 4.0 Service Pack 6a
- Windows NT Server 4.0 Service Pack 6a
- Windows NT Server 4.0 Terminal Server Edition
Service Pack 6
- Windows 2000 Service Pack 2
- Windows 2000 Service Pack 3
- Windows 2000 Service Pack 4
- The Microsoft .NET Framework, version 1.0
- The Microsoft .NET Framework, version 1.1
- Internet Explorer 6 Service Pack 1
- Picture It! 2002 (All versions)
- Greetings 2002
- Picture It! version 7.0 (All versions)
- Digital Image Pro version 7.0
- Picture It! version 9 (All versions)
Including Picture It! Library)
- Digital Image Pro version 9
- Digital Image Suite version 9
- Producer for Microsoft Office PowerPoint
(All versions)
- Visual Studio 2003 .NET
- Visual Basic .NET Standard 2003
- Visual C# .NET Standard 2003
- Visual C++ .NET Standard 2003
- Visual J# .NET Standard 2003
- Visual Studio 2002 .NET
- Visual Basic .NET Standard 2002
- Visual C# .NET Standard 2002
- Visual C++ .NET Standard 2002
- The Microsoft .NET Framework, version 1.0 SDK
- Platform SDK Redistributable: GDI+
- Review the FAQ section of bulletin MS04-O28 for
information about these operating systems:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition (SE)
- Microsoft Windows Millennium Edition (ME)
- Impact: Remote Code Execution
- Version Number: 1.0
Important Security Bulletins
============================
MS04-027 - Vulnerability in WordPerfect Converter Could
Allow Code Execution (884933)
- Affected Software:
- Office 2003
- Office XP Service Pack 3
- Office 2000 Service Pack 3
- Works Suite (All versions)
- Impact: Remote Code Execution
- Version Number: 1.0
And there's me telling me poor friends and family that they cant catch a virus from pics...:rolleyes:
Someone is using it already.
"Malicious hackers are seeding Internet news groups that traffic in pornography with JPEG images that take advantage of a recently disclosed security hole in Microsoft's software....."
Hackers Target Microsoft JPEG Hole
http://www.pcworld.com/news/article/...092804X,00.asp
Thanks for the heads up Duane. It just goes to illustrate how much more malicious the internet is becoming - it was months between the patch for the Blaster worm being released and an actual exploit appearing. This time round it's just been a matter of days :(
i still dont have that update yet in critical or priority
You can get it here.
MS04-028: Buffer overrun in JPEG processing (GDI+) could allow code execution (KB 833987)
http://support.microsoft.com/default...b;en-us;833987
duane if i have sp2 and dont have any of the others that they show should i download ?
No. XP SP2 does not contain a vulnerable version of the affected component. However, people who have installed any of the affected Office, Visio, or Project applications should install the updates for those applications.
frebo--Maybe you understood this all along--I did not for some time-- but the GDI+ "Update" you may have gotten from Windows Update, was only a diagnostic tool to determine if you needed the actual GDI+ Security Update. If after running Step 3, that diagnosis determines you need the actual update, based on analysis of programs other than XP SP2 on your PC, you will be told how to get it.
It took me some time to figure this out. I thought the original Windows Update offer was for the actual Security Update.
thanks duane, jim from what i can muster out of all this is it told me i didnt need the update. i have office premium2000 and have kept up with updates and the tool said i was not affected. i will look into it farther,thanks for pointing that out.
There are several threads about this jpeg exploit over at the security forum at dslreports. Apparently there is even a "test" version of the exploit available to run against your AV to see if it catches it. (Most AVs are stating they offer protection.) I haven't tried testing it. Call me chicken! Apparently one of the concerns is that the exploit can install remote administration!
One thing that has seriously bugged me with this MS problem is that MS has made the detection and steps to correct the problem about as confusing as I've ever seen from them. I can usually figure out what is kinda going on but this time...sheeeesh!
In my best run-on, confused sounding voice..."If you are running XP, the detection tool will only load from Windows Update. And when ran from there, it will only run once. XP SP2 is apparently safe but even if the MS tool says you're safe, there is another non-MS testing tool that can find other potential jpeg exploit problems. Some have ran that tool and found problems only to discover there are no patches for some of those programs. So you can't patch everything anyway!!!"
I guess that in the end, I'm kinda praying that my AV here at home and at work will catch this junk. ..
Now this Baffles Me.....I got my SP1 intergrated with XP Pro...Updates Done.
Over past few weeks Microsoft been trying to get me to Install SP2...I WONT Do That....(that's my Perogative)
Micro also said i was uptoDate with all my Updates.(except the ones I chose not to Install) Since going to the Link here today, micro told me to go into my Services n Redo my Auto Updates, BITS & Event Log, or it cant update...Funny that because it could before!!....So then Micro trys to Force SP2 onto me! then I get a FistFull of SP1 Criticall Updates.(so many I'm baffled)...All I needed or thought I needed was that JPG un!! KB833987
So Folks, any ideas as to why Micro has discovered that I need another TruckFull of SP1 Criticall Updates!! When i thought ALL SP1s had stoped..
Well!!!, I have been 100% Hoodwinked by Micro....(I reckon) I just did those Criticall updates (sp1) BUT...Once installed I discovered they be SP2....have I got the wrong end of the stick here!! are my faculties correct! or have I flipped my lid!!!!:rolleyes:
Micros Update Site did/does say SP1 Criticall Updates/Urgent, 24 in all but i cancelled WMP cause i dont use it, so 22 SP1s was installed....But Belarc says SP2...Who's correct....
The JPG un (KB833987) was not needed after all...
I want my PC to do what I choose, I want it to Work for ME, I do NOT Want Micro or anyone dictateing what i should or should not do, I get enough of that in my Life as it is!....SP2 is my Choice to Install or Not...I Choose NOT!!!
I am NOT Moaning/Whining/Whinging, Just stateing my Preferences ok...THANKS ALL.....You do a Great job here, Well Done..
Right-click 'My Computer' > Properties > (tab) General
You will be able to see what version you have here (Belarc is sometimes wrong).
SP1 is the one...But the Critical updates are now SP2....Not SP1 as Micro are saying.....
I probably needed the Acumalative update anyway.(which should be sp1 but turned out to be sp2)....Cheers.
I'm a bit of a Hater of All these Updates (SP1/SP2) because once I had a 5Gbt hard disk that was enough, then it was an 80Gbt HD that was enough, now with all these ruddy updates we need a 200Gbt hard disk.....lol.....Be Happy, Be Good..Be Carefull..
Here is the best help I've found yet for the GDI+ issue. I haven't had time to run through all of it yet but at least it's in English...(unlike MS's explanation!)
http://www.bleepingcomputer.com/forums/topict3077.html
I ran the GDI scan from that tutorial this morning. I came up with a file at C:\WINDOWS\SYSTEM32\gdiplus.dll that I don't know what to do with. The tutorial says "that I need to visit the web site of this application and see if there is any update available." I don't know where at Microsoft I'm supposed to find an update for it (or what application it applies to).
Duane: As I'm sure you can gather, I am no authority but wouldn't that file part of the Windows family?
Here is the link to the new GDI+ files from MS. I kinda gathered from the tutorial that we replace the old gdiplus.dll with new gdiplus.dll from the MS download. (And keep the old one in a separate folder as a backup in case we need it.)
But I can't honestly say for sure. Thus my point above on how badly MS is handling this situation. There has to be a clearer way to clean up the GDI+ mess...
Yes, it's a System32 dll (not an app) - thus, my uncertainty.
I'll check out the Platform SDK Redistributable GDI+.
Thanks, HAN.
Indeed, this seems rather mechanical way to solve the problem, and MS is offering little publicity or help.
I found five "vulnerable" versions of gdiplus.dll, two of which in Microsoft files.
C:\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDIPLUS.DLL
Version: 5.1.3097.0 <-- Vulnerable version
C:\I386\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
The new version from the SDK download is 5.1.3102.1360
Waiting to hear results from others who switch out the old with the new before I do it! :)
Also concerned what to do about the other three vulnerable versions. The advice is "that I need to visit the web site of this application and see if there is any update available", but I find nothing at the sites of the application about new versions of gdiplus.dll.
DuaneB--curious that you have your MS "vulnerable" version in a different folder than mine.
Well, I did it and now have two gdiplus.dll files in my System32 folder - gdiplus(old).dll (1,667KB) and gdiplus.dll (1,607KB). I don't smell any smoke. :D
Am I supposed to reboot to get this new protection?
I don't know why my System dlls are where they are.
I know I'm beating a dead horse here... But to say I am frustrated with all of this is an understatement of montrous proportions. Thought you all might like to read someone else's take... (albeit stated much more eloquently than I ever could have.)
Letter to MS.
Duane: Yeah, I'd reboot and then re-test.
I switched two out.. Ewido security suite (free a/v program) and Ipswitch WS_ftp pro9 .. no problems noticed.
I still have one other vulnerable file (red) ...
E:\WINDOWS\ServicePackFiles\i386\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
Not sure what to do about that yet.
I did do the MS critical patch before all of this BTW.
That was painful. When I rebooted my Video Display Adapter was knocked out and I couldn't replace it. I had to do a System Restore. I don't think i want to do that again.
fink, the tutorial says to ignore sxs.dlls.
right, thanks..
Here's the DSLreports page discussing the issue for anyone that wants more info...
http://www.dslreports.com/forum/rema...flat~days=9999
EDIT-
hmm.. what it says is..
"If it states that it finds DLLs in directories like Windows\$NtUniinstallKB or Windows\WinSxS, you can safely ignore them"
not actually the sxs.dll file itself.
This whole thing is really confusing.
Duane: Sorry it didn't go well. :(
Isn't this a bunch of hooey, that we all have to go through stuff like this? What is it going to take for MS to really give us all some good help?
I'm responsible for around 20 PCs at work and due to software related issues, I can't move all of the XP machines to SP2. And to top this off, some spokes guy from f-prot says yesterday or so that they can't guarantee protection. Apparently these jpg/jpeg files can masquerade as other file types and may get missed by AV scanners. So even my hope that AVs could save us is tenuous at best...
DuaneB--Ouch!! ButEDIT--I understand you renamed the old one, so it was disabled. That should have prevented problems.Quote:
Well, I did it and now have two gdiplus.dll files in my System32 folder - gdiplus(old).dll (1,667KB) and gdiplus.dll (1,607KB).
After you did a system restore, what gdiplus.dll was operative? Did you have any further problems?
Anyone else have success in substituting the old gdiplus.dll with the new?
I used the sxs.dll in my system32 folder to replace the servicepack/i386 version (which I think was dormant anyway) and now I get a clean, no red, scan. Hopefully that's the end of it.
There are so many conflicting and confusing articles and comments about this issue out there it's hard to know what's accurate and what isn't.
For anyone that's interested I d/l'd and tested my a/v programs on a copy of the jpeg virus that was found on usenet... Trend Micro's PCCillin found it right off both in zipped and jpg format but I had to unzip it for Kaspersky and Ewido to detect it which both did successfully after it was extracted to a temp folder.