News

Exploit Code Circulating for JPEG Flaw

The seriousness of an already critical flaw in the way a Microsoft component processes JPEG files got ratcheted up a notch this week as exploit code began circulating.

Microsoft released security bulletin MS04-028, which included patches for the flaw, on Sept. 14. In the worst case, the flaw could allow a remote attacker to take complete control of a user's computer over the Internet.

This week, several security experts have reported seeing exploit code, which opens a command line on the user's machine. Widely available exploit code is often a precursor to major worms or automated hacking tools, the kinds of things that make theoretical problems into actual crises.

"Over the last 24hrs, several exploits taking advantage of the JPEG GDI vulnerability (MS04-028) have been released. We expect a rapid [development] of additional exploits over the next few days," according to the Thursday handler's diary maintained by the SANS Institute.

The JPEG flaw arises from a Microsoft component responsible for processing JPEG images. It is a critical problem for Windows XP, Windows XP with Service Pack 1, Windows Server 2003, Internet Explorer 6 with Service Pack 1, Outlook 2002, Outlook 2003, the .NET Framework 1.0 with Service Pack 2 and the .NET Framework 1.1. It qualifies as an important security problem for dozens of other Microsoft products.

Microsoft warned that several third-party applications may also use the flawed component. SANS on Thursday also provided a GDI Scanner, which helps administrators find third-party versions of the component on their systems. A link to the tool is available from the SANS site (isc.sans.org/diary.php?date=2004-09-23).

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Windows Has Support for Encrypted DNS

    Microsoft announced this week that the Windows operating system already has support for an encrypted Domain Name System option that promises to add greater privacy protections for Internet connections.

  • The Datacenter in 2020 and Beyond: More Edge, 'As-a-Service' and AI

    The next few years are going to be lively ones for the datacenter, according to research firm IDC's "Futurescape" report.

  • Inking Gains Traction in Office 365

    From PowerPoint to Excel, Microsoft is beefing up its support for digital inking across its Office 365 apps. Here's a snapshot of upcoming features.

  • Salesforce and Microsoft Partnering on Azure Services and Teams

    Salesforce.com and Microsoft on Thursday announced a strategic partnership on cloud technology use.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.