Home > Threat descriptions >

Exploit:W32/JPG Vulnerability

Classification

Category: Malware

Type: Exploit

Aliases: MS04-028 exploit

Summary


A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.

Removal


Patch

Protection against the JPEG Vulnerability exploit (MS04-028)was released by Microsoft for Windows, Exchange and Office on October 12th, 2004. The necessary updates can be found:

  • http://www.microsoft.com/security/bulletins/200409_jpeg.mspx

To test whether your computer is vulnerable to the exploit, please use the following utility provided by Microsoft:

  • http://www.microsoft.com/downloads/details.aspx?familyid=71CD9E74-7142-4780-83E5-CE54401DA1D1&displaylang=en
Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


On September 24th, 2004, a vulnerability which allows code execution was found in Microsoft's GDI+ JPEG decoder (reported in our Lab Weblog). Microsoft posted detailed information on the vulnerability and affected systems in the MS04-028 bulletin:

  • http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

A proof-of-concept exploit which executes code on the victim's computer when opening a JPG file was posted to a public website on September 17th, 2004. That exploit only crashed the Internet Explorer web browser.

On September 24th, a constructor appeared that could produce JPG files with the MS04-028 exploit. This time the exploit executed a code that could download and run a file from Internet. However, the JPG file with the exploit has to be previewed locally for the exploit to get activated; viewing a JPG file from a remote host does not activate the exploit.

On October 12th, 2004, Microsoft released several critical updates for Windows, Exchange and Office, as well as an update for the patch of the JPG vulnerability (MS04-028). Further information and a complete list of updates is available at Microsoft's TechNet Security site:

  • http://www.microsoft.com/technet/security/bulletin/ms04-oct.mspx