MS04-028 exploit, COM length exploit, JPEG Processing (GDI+)
Summary
Update on October 12th, 2004:
Microsoft has released today several critical updates for Windows,
Exchange and Office. There is also update for the patch of the JPG
vulnearbility (MS04-028). Further information and complete list of the
updates is available at Microsoft's TechNet Security site:
a vulnerability, which allows code execution, has been found in
Microsoft's GDI+ JPEG decoder. Microsoft has posted detailed
information on the vulnerability and affected systems in the
MS04-028 bulletin:
A proof-of-concept exploit which executes code on the victim's
computer when opening a JPG file has been posted to a public
website on September 17th, 2004. That exploit was only crashing
Internet Explorer.
On September 24th there appeared a constructor that could produce
JPG files with the MS04-028 exploit. This time the exploit
executed a code that could download and run a file from Internet.
However, the JPG file with the exploit has to be previewed
locally for the exploit to get activated, viewing a JPG file from
a remote host does not activate the exploit.
We are expecting that more exploit techniques will be created by
hacker groups. And there is a chance that someone will create a
universal exploit that would work when viewing an image locally
and on a remote host.
It is advised to install security updates released by Microsoft
to be protected from the JPEG vulnerability exploit. These
updates can be downloaded from here:
To be protected from the exploit entering your system, it is
recommeded to obtain the application that scans incoming traffic,
for example F-Secure Internet Gatekeeper software and configure
it to scan all incoming image files (see the list of extensions
below).
F-Secure Anti-Virus detects the MS04-028 exploit since the 20th
of September. Detection is available since the 2004-09-20_01
update as 'Exploit.Win32.MS04-028.gen'.
IMPORTANT: F-Secure Anti-Virus does not scan JPG and other image
files with the default settings. In order to scan a computer for
files with JPG vulnerability exploit, it is necessary to either
scan all files on a hard disk or to add the following image
extensions to the list of scanned extensions:
NOTE: Adding the above listed extensions to FSAV's list of
scanned extension might reduce the scanner's perfomance as there
will many more files to scan on a hard disk.
