Threat Description

Exploit:​W32/JPG Vulnerability

Details

Aliases: MS04-028 exploit
Category: Malware
Type: Exploit
Platform: W32

Summary



A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.



Removal



Patch

Protection against the JPEG Vulnerability exploit (MS04-028)was released by Microsoft for Windows, Exchange and Office on October 12th, 2004. The necessary updates can be found:

  • http://www.microsoft.com/security/bulletins/200409_jpeg.mspx

To test whether your computer is vulnerable to the exploit, please use the following utility provided by Microsoft:

  • http://www.microsoft.com/downloads/details.aspx?familyid=71CD9E74-7142-4780-83E5-CE54401DA1D1&displaylang=en


Technical Details



On September 24th, 2004, a vulnerability which allows code execution was found in Microsoft's GDI+ JPEG decoder (reported in our Lab Weblog). Microsoft posted detailed information on the vulnerability and affected systems in the MS04-028 bulletin:

  • http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

A proof-of-concept exploit which executes code on the victim's computer when opening a JPG file was posted to a public website on September 17th, 2004. That exploit only crashed the Internet Explorer web browser.

On September 24th, a constructor appeared that could produce JPG files with the MS04-028 exploit. This time the exploit executed a code that could download and run a file from Internet. However, the JPG file with the exploit has to be previewed locally for the exploit to get activated; viewing a JPG file from a remote host does not activate the exploit.

On October 12th, 2004, Microsoft released several critical updates for Windows, Exchange and Office, as well as an update for the patch of the JPG vulnerability (MS04-028). Further information and a complete list of updates is available at Microsoft's TechNet Security site:

  • http://www.microsoft.com/technet/security/bulletin/ms04-oct.mspx





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More