Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security NTBugtraq
[Top] [All Lists]

Re: Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG

Subject: Re: Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)
Date: Wed, 15 Sep 2004 08:42:22 -0400
Here's a couple of points to clear up several messages received;

1. To all those people who keep asking why 833989 appears as an IE update, its 
because it is. Its the IE version of MS04-028. If you're running an OS which 
doesn't have an OS version of GDI+ (e.g. Windows 2000), but you have IE 6 
installed, WU will download the IE 6 version.

2. Windows XP Gold or XP SP1 *has* an OS version. So you don't need the IE 6 
patch on XP, you need the XP patch. I have one report so far from Aras "Russ" 
Memisyazici who says that applying the XP patch directly to an XP SP1 system 
reports that its already "applied". Its possible this has to do with the fact 
that Office on XP uses the XP OS version of GDI+. IOWs, if Office was updated 
first on an XP Gold or SP1 system, its possible that the OS version of GDI+ was 
updated, meaning when you then try the XP OS patch, it says its already 
"applied"...just speculating.

3. So far its been difficult to determine whether WU is actually installing the 
IE 6 version, or not. I believe it is, but if anyone out there has been to WU 
(or SUS) with W2K and IE 6 and then run the GDI+ Detection Tool and had it say 
they needed to update IE (with 833989), let me know.

4. I believe everyone gets the GDI+ Detection Tool.

5. The .Net Framework "patches" aren't, they're new SPs instead.

6. Office should be patched via OfficeUpdate. I'd appreciate hearing from 
people who have been there (and not just WU). Did it work, didn't it, etc...

Cheers,
Russ - NTBugtraq Editor

-----
NTBugtraq Editor's Note:

Want to reply to the person who sent this message? This list is configured such 
that just hitting reply is going to result in the message coming to the list, 
not to the individual who sent the message. This was done to help reduce the 
number of Out of Office messages posters received. So if you want to send a 
reply just to the poster, you'll have to copy their email address out of the 
message and place it in your TO: field.
-----

<Prev in Thread] Current Thread [Next in Thread>