JPEG Virus - Are you Vulnerable?

TheBlueRaja · 01-10-2004, 10:00

Use this program found here to see if you are vulnerable to the JPEG virus.

This will tell you which programs that you have installed are vulnerable to attack.

Remember - lots of programs are affected by this bug.

Bifta · 01-10-2004, 10:07

Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
Version: 11.0.5207.5
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2900.2180
C:\Program Files\Macromedia\Dreamweaver MX 2004\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL
Version: 6.0.3255.0 <-- Vulnerable version
C:\WINDOWS\$NtServicePackUninstall$\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\$NtServicePackUninstall$\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes)
C:\WINDOWS\ServicePackFiles\i386\sxs.dll
Version: 5.1.2600.2180
C:\WINDOWS\ServicePackFiles\i386\vgx.dll
Version: 6.0.2900.2180
C:\WINDOWS\system32\GdiPlus.dll
Version: 5.1.3102.2180
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.2180
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll
Version: 5.1.3102.2180
Scan Complete.

I installed the GDI patch a week or two ago, how do I get round this?

Nemesis · 01-10-2004, 10:08

Quote:

Scanning Drive C:...
C:\dell\I386\ASMS\1000\MSFT\WINDOWS\GDIPLUS\GDIPLU S.DLL
Version: 5.1.3097.0 <-- Vulnerable version

C:\dell\I386\SXS.DLL
Version: 5.1.2600.1106 <-- Vulnerable version

C:\dell\I386\VGX.DLL
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)

C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2900.2180

C:\WINDOWS\$NtServicePackUninstall$\sxs.dll
Version: 5.1.2600.1515

C:\WINDOWS\$NtServicePackUninstall$\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)

C:\WINDOWS\$NtUninstallKB833998$\sxs.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)

C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)

C:\WINDOWS\ServicePackFiles\i386\sxs.dll
Version: 5.1.2600.2180

C:\WINDOWS\ServicePackFiles\i386\vgx.dll
Version: 6.0.2900.2180

C:\WINDOWS\SYSTEM32\sxs.dll
Version: 5.1.2600.2180

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll
Version: 5.1.3102.2180

Scan Complete.

And that's with a fully patched XP system

basa · 01-10-2004, 10:46

Good job I'm staying with 98SE ! and Opera

Oh and I don't use any of the other MS stuff either .. good old 'Open Office' for me !

TheBlueRaja · 01-10-2004, 11:18

The problem that this highlights is that it is NOT JUST XP that is affected - any program which handles JPEG's can be. The only way to make sur eyou are not vulnerable is to update EVERY program which has the possibility of being affected by the vulnerability.

Look on the bright side - at least you now know exactly what needs to be updated on your systems.

Jon M · 01-10-2004, 11:31

Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.DLL
Version: 6.0.2800.1411
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\gdiplus .dll
Version: 5.1.3101.0 <-- Vulnerable version
C:\WINNT\system32\dllcache\vgx.dll
Version: 6.0.2800.1411
Scan Complete.
Scanning Drive D:...
D:\Creative Suite\Adobe Illustrator CS\Support Files\Contents\Windows\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
D:\HandySnap\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
Scan Complete.

Not too bad...

zoombini · 01-10-2004, 13:53

Scanning Drive C:...
C:\Program Files\porn\pornview.exe
Version: 1.3 <-- Vulnerable version
C:\Program Files\porn\pornpic.exe
Version: 7.3 <-- Vulnerable version
C:\Program Files\porn\dirtygit.exe
Version: 7.3 <-- Vulnerable version
Scan Complete.

OH NO - Thats my porn watching buggered.

Nugget · 01-10-2004, 14:07

Quote:

Originally Posted by zoombini

Scanning Drive C:...
C:\Program Files\porn\pornview.exe
Version: 1.3 <-- Vulnerable version
C:\Program Files\porn\pornpic.exe
Version: 7.3 <-- Vulnerable version
C:\Program Files\porn\dirtygit.exe
Version: 7.3 <-- Vulnerable version
Scan Complete.

OH NO - Thats my porn watching buggered.

Ahem, you may want to rephrase that

Ramrod · 01-10-2004, 14:11

Quote:

Originally Posted by zoombini

Scanning Drive C:...
C:\Program Files\porn\pornview.exe
Version: 1.3 <-- Vulnerable version
C:\Program Files\porn\pornpic.exe
Version: 7.3 <-- Vulnerable version
C:\Program Files\porn\dirtygit.exe
Version: 7.3 <-- Vulnerable version
Scan Complete.

OH NO - Thats my porn watching buggered.

pmsl........someone rep him for that please!

Jon M · 01-10-2004, 14:18

Quote:

Originally Posted by Ramrod

pmsl........someone rep him for that please!

Done

Nugget · 01-10-2004, 14:22

Quote:

Originally Posted by Ramrod

pmsl........someone rep him for that please!

And done again - that's definitely worth a couple!

bopdude · 01-10-2004, 14:25

Quote:

Originally Posted by Ramrod

pmsl........someone rep him for that please!

Done, lol lol lol

zoombini · 01-10-2004, 16:15

WOW! 5.... got to be witty more often..lol
Thanks for that..lol

I actually have about 5 entries that are identified.

Quote:

Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall purposes)
C:\WINDOWS\system32\dllcache\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\system32\dllcache\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6 SP1 only)
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
Scan Complete.

.
Although I haven't a clue what to do about it.
Maybe I'll put SP2 on next week, I can't use Win update at present till the IT dept get the poxy proxy sorted.

MovedGoalPosts · 01-10-2004, 16:39

We should all remember that whilst patching our computer software is an unending task, current antivirus software is also an essential part of our security.

If your A/V is current, and updated very regularly (at least once a day), you are going to be extremely unlikely to get an infection on your PC, even if it isnt quite fully patched. The A/V will scan any files as they are opened, detect something amis and prevent it's deployment.

Bear in mind that windoze update and similar patching software often lags behind in real time to the detection of vulnerabilities, as things have to be properly tested. It's much easier to test and inocculate against a virus as it's small amount of code con be unpicked and behavior predicted. Thus A/V can be far more current than the patches available. Having said that the jpeg vulrnerability has been known of for a few weeks now, long enough for any good software manufacturer to have the patches available.

TheBlueRaja · 01-10-2004, 16:48

Upgrades to get yourself patched...

Microsoft Service Pack .NET Framework 1.1 Service Pack 1
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft .NET Framework SDK 1.0 SP2:

Microsoft Service Pack .NET Framework 1.0 Service Pack 3
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft .NET Framework SDK 1.0 SP1:

Microsoft Service Pack .NET Framework 1.0 Service Pack 3
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft .NET Framework SDK 1.0:

Microsoft Service Pack .NET Framework 1.0 Service Pack 3
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Digital Image Pro 7.0:

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Digital Image Pro 9.0:

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Digital Image Suite 9.0:

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Greetings 2002 :

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Internet Explorer 6.0 SP1:

Microsoft Patch Security Update for Internet Explorer 6 Service Pack 1: KB833989
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Office 2003 :

Microsoft Upgrade Office 2003 Service Pack 1
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Upgrade Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Office XP SP3:

Microsoft Upgrade Office XP Security Update: KB832332
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Picture It! 7.0:

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Picture It! 9.0:

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Picture It! 2002 :

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Picture It! Library :

Microsoft Patch Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Platform SDK Redistributable: GDI+ :

Microsoft Patch Platform SDK Redistributable: GDI+
http://download.microsoft.com/downlo...iplus_dnld.exe

Microsoft Producer for Microsoft Office PowerPoint :

Microsoft Patch Producer for Microsoft Office PowerPoint 2003
http://www.microsoft.com/downloads/d...DisplayLang=en

Microsoft Project 2002 SP1:

Microsoft Upgrade Project 2002 Security Update: KB831931
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Project 2002 :
Microsoft Project 2003 :

Microsoft Upgrade Project 2003 Service Pack 1
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Upgrade Project 2003 Security Update: KB838344
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Visio 2002 Professional SP2:

Microsoft Upgrade Visio 2002 Security Update: KB831932
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Visio 2002 Standard SP2:

Microsoft Upgrade Visio 2002 Security Update: KB831932
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Visio 2003 Professional :

Microsoft Upgrade Visio 2003 Security Update: KB838345
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Visio 2003 Standard :

Microsoft Upgrade Visio 2003 Security Update: KB838345
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Visual Studio .NET 2002 :

Microsoft Upgrade Visual Studio .NET 2002 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Visual Studio .NET 2003 :

Microsoft Upgrade Visual Studio .NET 2003 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/d...displaylang=en

Microsoft Windows Server 2003 Datacenter Edition :

Microsoft Patch Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows Server 2003 Datacenter Edition 64-bit :

Microsoft Patch Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987
http://download.microsoft.com/downlo...7-IA64-ENU.EXE

Microsoft Windows Server 2003 Enterprise Edition :

Microsoft Patch Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows Server 2003 Enterprise Edition 64-bit :

Microsoft Patch Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987
http://download.microsoft.com/downlo...7-IA64-ENU.EXE

Microsoft Windows Server 2003 Standard Edition :

Microsoft Patch Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows Server 2003 Web Edition :

Microsoft Patch Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows XP 64-bit Edition SP1:

Microsoft Patch Security Update for Windows XP 64-bit Edition (KB833987)
http://download.microsoft.com/downlo...7-ia64-ENU.EXE

Microsoft Windows XP 64-bit Edition :

Microsoft Patch Security Update for Windows XP 64-bit Edition (KB833987)
http://download.microsoft.com/downlo...7-ia64-ENU.EXE

Microsoft Windows XP 64-bit Edition Version 2003 :

Microsoft Patch Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987
http://download.microsoft.com/downlo...7-IA64-ENU.EXE

Microsoft Windows XP Home SP1:

Microsoft Patch Security Update for Windows XP (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows XP Home :

Microsoft Patch Security Update for Windows XP (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows XP Professional SP1:

Microsoft Patch Security Update for Windows XP (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

Microsoft Windows XP Professional :

Microsoft Patch Security Update for Windows XP (KB833987)
http://download.microsoft.com/downlo...87-x86-ENU.EXE

References
Source: CERT TA04-260A Microsoft Windows JPEG component buffer overflow
URL: http://online.securityfocus.com/advisories/7211

Source: Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow
URL: msg://bugtraq/414770A2.9030603@verizon.net

Source: Microsoft Security Bulletin MS04-028
URL: http://www.microsoft.com/technet/sec.../ms04-028.mspx

Source: Netscape Communicator JPEG-Comment Heap Overwrite Vulnerability
URL: http://www.securityfocus.com/bid/1503

Source: RE: old netscape vuln - affecting XP/explorer?
URL: http://www.securityfocus.com/archive/82/290856