Exploit:W32/JPG Vulnerability

Classification

Malware

Exploit

W32

MS04-028 exploit

Summary

A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.

Manual action: Patch

Protection against the JPEG Vulnerability exploit (MS04-028)was released by Microsoft for Windows, Exchange and Office on October 12th, 2004. The necessary updates can be found:

  • http://www.microsoft.com/security/bulletins/200409_jpeg.mspx

To test whether your computer is vulnerable to the exploit, please use the following utility provided by Microsoft:

  • http://www.microsoft.com/downloads/details.aspx?familyid=71CD9E74-7142-4780-83E5-CE54401DA1D1&displaylang=en

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Community

Find the latest advice in our Community.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

On September 24th, 2004, a vulnerability which allows code execution was found in Microsoft's GDI+ JPEG decoder (reported in our Lab Weblog). Microsoft posted detailed information on the vulnerability and affected systems in the MS04-028 bulletin:

  • http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

A proof-of-concept exploit which executes code on the victim's computer when opening a JPG file was posted to a public website on September 17th, 2004. That exploit only crashed the Internet Explorer web browser.

On September 24th, a constructor appeared that could produce JPG files with the MS04-028 exploit. This time the exploit executed a code that could download and run a file from Internet. However, the JPG file with the exploit has to be previewed locally for the exploit to get activated; viewing a JPG file from a remote host does not activate the exploit.

On October 12th, 2004, Microsoft released several critical updates for Windows, Exchange and Office, as well as an update for the patch of the JPG vulnerability (MS04-028). Further information and a complete list of updates is available at Microsoft's TechNet Security site:

  • http://www.microsoft.com/technet/security/bulletin/ms04-oct.mspx