JPEG Vulnerability after patch!

Printable View

September 30th, 2004, 04:06 AM
STeRoiD

JPEG Vulnerability after patch!

Bottom line : the exploit still runs on my computer, after i have patched my machine! help!

Details :
I use WinXP SP1.

I have download and "patched" my machine from here :
http://www.microsoft.com/technet/sec.../ms04-028.mspx
(File called WindowsXP-KB833987-x86-ENU.EXE)

After I have patched my comp, I compiled the local exploit from here :
[edit : was a link to GDI+ buffer overrun exploit by FoToZ]

and its still working! its running cmd.exe as soon as i view the folder with the picture.

Plz Help! :(

<GDI scan results>
Scanning Drive C:...
C:\Program Files\Camera Suite\PhotoImpression\Share\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
C:\Program Files\Common Files\Microsoft Shared\Office10\MSO.DLL
Version: 10.0.3311.0 <-- Possibly vulnerable (Under OfficeXP only)
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\$NtServicePackUninstall$\sxs.dll
Version: 5.1.2600.0 <-- Vulnerable version
C:\WINDOWS\$NtServicePackUninstall$\vgx.dll
Version: 6.0.2600.0 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes)
C:\WINDOWS\LastGood\System32\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\ServicePackFiles\i386\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\ServicePackFiles\i386\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\GdiPlus.dll
Version: 5.1.3102.1360
Scan Complete.
</GDI scan results>

PS : No, I dont want to upgrade to SP2.
September 30th, 2004, 04:21 AM
muert0

i took a deep breath before I said anything mean...

If you don't have SP2 you aren't fully patched numbskull.
September 30th, 2004, 05:47 AM
Winston

Can you please remove the link to the exploit code.

I'm not going to neg you because the question was valid, but we don't need the code freely avalable on this site.
September 30th, 2004, 08:28 AM
Simple Simon

You're Not Fully Patched ...

Quote:

Posted by STeRoiD

PS : No, I dont want to upgrade to SP2.

Why not? Perhaps you have a "Hot," copy of Windows XP and are worried about the consequences of installing SP2? ;)

Are you using XP home or XP Pro?

If you're serious about security you should install SP2!

Silly question ... Did you re-load Windows after installing the patch?

Anyone out there know if the patch linked to in STeRoiD's post is dependent on other patches? There's no mention of dependencies on the page linked to.
September 30th, 2004, 08:48 AM
cgkanchi

Quote:

Can you please remove the link to the exploit code.

I'm not going to neg you because the question was valid, but we don't need the code freely avalable on this site.

Why not? Isn't that what the site is meant to be? Hardcore discussions on security issues. If someone links to (POC) exploit code and NOT readymade executables, I don't see the problem. Most skiddies don't have the skills (or the patience) required to compile code anyway.

Quote:

Why not? Perhaps you have a "Hot," copy of Windows XP and are worried about the consequences of installing SP2?

Makes no difference. As long as your key allowed you to install SP1, you can install SP2 as well.

Quote:

If you're serious about security you should install SP2!

I agree wholeheartedly! XP has been extensively tweaked with SP2 to improve the overall security. This of course, is besides the HUGE number of fixes in SP2.

Cheers,
cgkanchi
September 30th, 2004, 11:37 AM
IKnowNot

Just curious: what program is associated with .jpeg files on your computer?

Looking through your GDI scan, all I can see ( with one eye closed to try and focus on the screen ) is that PhotoImpression and Office 10 have the only “private” dlls that would be vulnerable and accessed. I do not believe even SP2 would change those dlls. For Office, you would have to visit the Office update site, and for PhotoImpression you would have to find out if they have an update, or remove the offending file and see if the program works without it ( it should use the default in the system folder then: if it is truly a “private” dll then this may not work, you may have to replace it, but PhotoImpression should provide an updated version. )

Any one else see anything different?

edit: forgot to mention: I agree with cgkanchi about Winston’s statements

Quote:

Can you please remove the link to the exploit code.

I'm not going to neg you because the question was valid, but we don't need the code freely avalable on this site.

I won’t neg Winston because the sentiments were genuine, however misdirected. ;) There is and extremely FINE LINE here as to what is acceptable and what is not, and all of us seem to have the line skewed for us now and then. /edit
September 30th, 2004, 03:04 PM
SDK

Look at the file that are vulnerable and the file are not vulnerable.. Look at the directory path that the file are vulnerable.. That will answer your question...
September 30th, 2004, 03:12 PM
MrLinus

I'm curious as to why there is "fuss" over the link to the VERY PUBLIC exploit code. K-Optik is a well know site, much like Packet Storm Security. This code, IIRC, was released AFTER the patch in question. To me, it just strikes me that the author is trying to be clear as to what they had done and what specifically they had used to test it with.

Perhaps someone could clarify?
September 30th, 2004, 05:44 PM
cgkanchi

Quote:

I'm curious as to why there is "fuss" over the link to the VERY PUBLIC exploit code. K-Optik is a well know site, much like Packet Storm Security. This code, IIRC, was released AFTER the patch in question. To me, it just strikes me that the author is trying to be clear as to what they had done and what specifically they had used to test it with.

I agree MsM. Exploit code IMHO, is to be studied and linked to as much as possible so that you know exactly what you're up against.

Cheers,
cgkanchi
September 30th, 2004, 07:51 PM
STeRoiD

First, although I think its valid, I removed the public exploit link because of the discussion.

Quote:

If you don't have SP2 you aren't fully patched numbskull

Quote:

If you're serious about security you should install SP2!

Ok, SP2 improves your security. Actually I didnt install it because all of the problems I heared about the product, but now maybe I will install it... but thats not the point : Does anyone who have XP SP1 MUST to install SP2? I mean, isnt microsoft supposed to support the SP1 community either (which means, amongst other things, suply a *working* patch for it)?

Myabe it has to do with the article "Microsoft: To secure IE, upgrade to XP"
http://news.com.com/Microsoft+To+sec...3-5378366.html

But seriously, I dont see any reason why XP SP1 will still be vulnerable.

Quote:

Just curious: what program is associated with .jpeg files on your computer?

The default one, "microsoft picture and fax viewer", but I didnt have to open the file. I didnt double-click him. I just pointed him within the Explorer

Quote:

Are you using XP home or XP Pro?

Pro.
September 30th, 2004, 11:35 PM
Simple Simon

I Can See Your Point STeRoiD ...

Quote:

Originally posted by STeRoiD
First, although I think its valid, I removed the public exploit link because of the discussion.

I'd have left it. I can't see a problem with it, after all it's public. ;)

Quote:

Ok, SP2 improves your security. Actually I didnt install it because all of the problems I heared about the product, but now maybe I will install it... but thats not the point : Does anyone who have XP SP1 MUST to install SP2? I mean, isnt microsoft supposed to support the SP1 community either (which means, amongst other things, suply a *working* patch for it)?
Myabe it has to do with the article "Microsoft: To secure IE, upgrade to XP"
http://news.com.com/Microsoft+To+sec...3-5378366.html

But seriously, I dont see any reason why XP SP1 will still be vulnerable.

Given that SP2 implements fixes at kernel level, etc, I consider it essential! Yes, some people have had problems, but if the proper precautions are taken (backups anyone) then they're not insurmountable. Install SP2

If XP SP1 is not vulnerable, why did Microsoft release SP2? Can you see why XP SP1 is vulnerable now? :)

Microsoft Support a fully patched XP. First thing they will recommend is get to the latest patch level. The patch for SP1 is SP2! lol
October 1st, 2004, 02:01 AM
muert0

I tryed to post before I left the house this afternoon but my cable went out. So here's what I had to say now.
It's not a matter of supporting SP1 or SP2 community. SP2 is the next batch of patches. It's not like upgrading from windows98 to windowsxp.

And I'm sorry for calling you a numbskull.
October 1st, 2004, 06:23 AM
yourdeadin

i am with steroid

Quote:

Ok, SP2 improves your security. Actually I didnt install it because all of the problems I heared about the product, but now maybe I will install it... but thats not the point : Does anyone who have XP SP1 MUST to install SP2? I mean, isnt microsoft supposed to support the SP1 community either (which means, amongst other things, suply a *working* patch for it)?

i am with steroid , many people who i talk to do not want to move to sp 2 as they have had many problems with sp 2 , even though they have a "hot copy" ( as cgkanchi said doesn't matter) they have a feeling sp 2 slows down their computer , and more over as steroid said , this is not the soution to the problem is it ,m$ id suposed to support the Sp 1 Community.
:confused:
October 1st, 2004, 06:36 AM
muert0

It's not an SP1 or 2 community it's a new update....
They put a lot of time and money into this update so why should they just waste more time making updates for people who are just making assumptions about something they don't know about???

Maybe they should just rename the update SP1-a so it will make you feel a little better...
October 1st, 2004, 06:55 AM
HTRegz

Hey Hey,

Being fully up-to-date has nothing to do with ServicePack2... Updates are released and installed independantly (if you so prefer)... and it most definately has nothing to do with the GDI+ vulnerability.

As for not installing SP2 (off topic... but oh well) there are plent of reasons to not install it...

1. Most Companies (with full IT Support) aren't rolling it out yet... so why would a home user want to experiment with it and jeopardize system stability if it isn't a test system. Many ISS/TSS divisions will tell you straight up not to install it.
2. There have been cases where Network Printing Functionality was lost.
3. There have been cases where Wireless Problems have resulted.
4. VS .Net and SP2 Don't completely like eachother... So much so that students have had to do full system reinstalls to get VS.Net functioning again..
5. 75%+ of Experienced Users (which I'd like to think encompasses most of AO) will turn of the XP firewall in favour of some third party app or hardware firewall.... This is their primary Security feature... and if it's turned off then how security related is the release really.
6. Several addition services are started... these are relatively new and could end up hurting the user more than their previous setup did.
7. Various Dell Laptops have had reported problems (I believe it was TH13 that raised this issue)
8. Various 64-bit AMD processors have reported problems...
9. MS Has already released one "patch/rollup" to SP2.... While this isn't there worst release ever... it's prolly pretty close to it when you talk about affecting home users.... and why not wait until it's a little more stable before installing it?
10. (Personal Preferance here) That damn Security Centre Service is annoying as all hell and quite useless...

Anyways as far as the GDI+ exploit... I'm sure this has already been mentioend but I'll reiterate because of the importance.... Windows Updates (and the MS Patch) only Patches your OS... It has nothing to do with third party apps (MS Apps included)... visit the Office update site to update your office and the manufacturers of other various affected software that you have to update them....

Peace,
HT