Exploit:W32/JPG Vulnerability

Classification

Category :

Malware

Type :

Exploit

Platform :

W32

Aliases :

MS04-028 exploit

Summary

A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.

Removal

Manual action: Patch

Protection against the JPEG Vulnerability exploit (MS04-028)was released by Microsoft for Windows, Exchange and Office on October 12th, 2004. The necessary updates can be found:

http://www.microsoft.com/security/bulletins/200409_jpeg.mspx

To test whether your computer is vulnerable to the exploit, please use the following utility provided by Microsoft:

http://www.microsoft.com/downloads/details.aspx?familyid=71CD9E74-7142-4780-83E5-CE54401DA1D1&displaylang=en

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates

First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample

After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning

If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

Note: You need administrative rights to change the settings.

Technical Details

On September 24th, 2004, a vulnerability which allows code execution was found in Microsoft's GDI+ JPEG decoder (reported in our Lab Weblog). Microsoft posted detailed information on the vulnerability and affected systems in the MS04-028 bulletin:

http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

A proof-of-concept exploit which executes code on the victim's computer when opening a JPG file was posted to a public website on September 17th, 2004. That exploit only crashed the Internet Explorer web browser.

On September 24th, a constructor appeared that could produce JPG files with the MS04-028 exploit. This time the exploit executed a code that could download and run a file from Internet. However, the JPG file with the exploit has to be previewed locally for the exploit to get activated; viewing a JPG file from a remote host does not activate the exploit.

On October 12th, 2004, Microsoft released several critical updates for Windows, Exchange and Office, as well as an update for the patch of the JPG vulnerability (MS04-028). Further information and a complete list of updates is available at Microsoft's TechNet Security site:

http://www.microsoft.com/technet/security/bulletin/ms04-oct.mspx

More Support

Community

Ask questions in our Community .

User Guides

Check the user guide for instructions.

Contact Support

Chat with or call an expert.

Submit a Sample

Submit a file or URL for analysis.