Jpeg vulnerabilty (please read)

**Elysian** · 10-03-2004, 11:59 AM

Pleas read this, it should concern everyone who coms in 'contact' with jpeg images; in E-mails, on web sites, stored jpegs, etc. Windows operating systems and applications can both be vulnerable.

http://www.microsoft.com/security/bu...0409_jpeg.mspx

My experiences so far; your operating system is well protected if you use Windows XP SP2. This doesn't mean applications will be protected.
In my case I had to patch Office XP, even if it had SP3.

Something that worries me more is this; how many of you use Google to look for images. Well I did today and this is the message that I received from my Firewall, in my case Sygate Personal Firewall Pro 5.5. build 2710;

[217] Microsoft Multiple Application/OS GDI+ JPEG Processing Buffer Overflow Vulnerability attempt detected

I got this message 3 times now while surfing Google images for a short time. Its severity was high enough fro the Firewall to block the Google images site for 10 minutes. See it as a warning guys.

It's only a vulnerabilty at this time, but security experts have information that several hacker groups are working hard to make use of this vulnerability (I'll see if I can find the article). They say that it's just a matter of time before Jpegs are used to hack your computer or to spread viruses.

Make sure that you use Microsoft's GDI+ Detection Tool http://www.microsoft.com/security/bu...0409_jpeg.mspx
You can also download it using the Microsoft Updates tool.

Be aware; if read several articles in which people said not to trust the tool, since they had experienced that it ignored files that actually needed to be patched.

My advice is to go to http://www.microsoft.com/technet/sec.../MS04-028.mspx and download all the updates manually.

Also make sure that you have the latest updates for your virus scanner. Yesterday I read that F-Prot v3.155b is already protecting systems again this possible thread.

I don't want to scare anyone, I just want to make that you guys takes this very serious.

Maybe it turns out all to be a hype (wouldn't be the first time), but the question is; do you want to take the risk...

One thing confuses me though; if Microsoft is patching its applications... why is it that we don't hear anything from companies like Adobe, Ulead, Macromedia, etc... makes you wonder.

**Clicker** · 10-03-2004, 01:31 PM

Thanks for the Detailed info, Elysian...

**mjm** · 10-03-2004, 01:33 PM

It's only a vulnerabilty at this time, but security experts have information that several hacker groups are working hard to make use of this vulnerability (I'll see if I can find the article). They say that it's just a matter of time before Jpegs are used to hack your computer or to spread viruses.

this is wrong, their are exploits in the wild for this now. easynews discovered it on the 28th, http://easynews.com/virus.html

computers are scary if you dont understand what you are doing. make sure you are patched and use good security practices.

my suggestions (full time system administrator for 250+ users & part time consultant for a bunch of small businesses).
DO NOT USE INTERNET EXPLORER! Firefox is a much superior browser, http://www.mozilla.org/products/firefox/
DO NOT USE OUTLOOK (or EXPRESS) FOR EMAIL! Thunderbird is a much better solution http://www.mozilla.org/products/thunderbird/
If you must use MS Office make sure it is fully patched. If you can I _highly_ suggest using OpenOffice http://www.openoffice.org/ Has about 95% of the functionality of Office and it is FREE.
DO NOT WORK AS ADMINISTRATOR!! That will help a ton with spyware and other crap.
Use a good firewall.
Use Anti-Virus if you didn't already do all this stuff on the list.

**Elysian** · 10-03-2004, 02:44 PM

Originally Posted by mjm

this is wrong, their are exploits in the wild for this now. easynews discovered it on the 28th, http://easynews.com/virus.html.

Thanks, didn't know that yet, not important to know in my initial post, since I was already prepairing people for the risks that were/are ahead of them.

But now let's not all panic and suddenly get rid of Office, IE, Outlook (Express), etc.
Let's be honest; how many people who use private computers and install every update and use strict security of any kind have been hacked? Also a hacker who scans an IP range and finds 1 or 3 computer at one location is not that interested. That doesn't mean of course that you don't need to protect yourself as good as possible, but that doesn't mean we all need to go into extremes like switching everything to Linux (although I wonder if that system is more secure...) and no need for all these applications that MJM mentioned; they aren't secure either, trust me on that and if a hacker wants to get in, then he WILL get in.

I'm a heavy computer user and I was only infected once in 17 years with a virus. Big deal.
And those users who have have a safe backup, don't have to worry at all. Just clean up the mess if something goes wrong; restore your OS image and restore your data, should take 30 min at the most for the majority of home users (98% unattended)

I'm not talking here about what's best for a company; my thread is targeted at private users.

**mjm** · 10-03-2004, 04:51 PM