BID:11173

Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability

Info

Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability

Bugtraq ID:	11173
Class:	Boundary Condition Error
CVE:	CVE-2004-0200
Remote:	Yes
Local:	No
Published:	Sep 14 2004 12:00AM
Updated:	Jul 12 2009 07:06AM
Credit:	This issue was discovered by Cassidy Macfarlane and later independently rediscovered by Nick Debaggis. The issue is similar in nature to BID 1503, discovered by Solar Designer.
Vulnerable:	Microsoft Word 2003 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Word 2002 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Messenger 5.0 Microsoft Visual Studio .NET 2003 + Microsoft Visual Basic .NET Standard 2003 + Microsoft Visual C# .NET Standard 2003 + Microsoft Visual C++ .NET Standard 2003 + Microsoft Visual J# .NET Standard 2003 Microsoft Visual Studio .NET 2002 + Microsoft Visual Basic .NET Standard 2002 + Microsoft Visual C# .NET Standard 2002 + Microsoft Visual C++ .NET Standard 2002 Microsoft Visual J# .NET Standard 2003 Microsoft Visual FoxPro Runtime Library 8.0 Microsoft Visual FoxPro 8.0 Microsoft Visual C++ .NET Standard 2003 Microsoft Visual C++ .NET Standard 2002 Microsoft Visual C# .NET Standard 2003 Microsoft Visual C# .NET Standard 2002 Microsoft Visual Basic .NET Standard 2003 Microsoft Visual Basic .NET Standard 2002 Microsoft Visio 2003 Standard Microsoft Visio 2003 Professional Microsoft Visio 2003 Microsoft Visio 2002 Standard SP2 Microsoft Visio 2002 Professional SP2 Microsoft Visio 2002 SP2 Microsoft Visio 2002 SP1 Microsoft Visio 2002 Microsoft Publisher 2003 Microsoft Publisher 2002 SP3 Microsoft Publisher 2002 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Project 2003 Microsoft Project 2002 SP1 Microsoft Project 2002 Microsoft Producer for Microsoft Office PowerPoint Microsoft PowerPoint 2003 0 + Microsoft Office 2003 0 Microsoft PowerPoint 2002 SP3 Microsoft PowerPoint 2002 SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft PowerPoint 2002 SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 Microsoft PowerPoint 2002 + Microsoft Office XP - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 Microsoft Platform SDK Redistributable: GDI+ Microsoft Picture It! Library + Microsoft MSN Messenger Service 9.0 Microsoft Picture It! 2002 Microsoft Picture It! 9.0 + Microsoft MSN Messenger Service 9.0 + Microsoft MSN Messenger Service 9.0 Microsoft Picture It! 7.0 Microsoft Outlook 2003 0 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Outlook 2002 SP3 Microsoft Outlook 2002 SP3 + Microsoft Office XP SP3 + Microsoft Office XP SP3 Microsoft Outlook 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Terminal Services SP3 - Microsoft Windows 2000 Terminal Services SP3 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft Outlook 2002 SP1 + Microsoft Office XP SP1 + Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft Outlook 2002 0 + Microsoft Office XP + Microsoft Office XP + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Home - Microsoft Windows XP Professional - Microsoft Windows XP Professional - Microsoft Windows XP Professional Microsoft OneNote 2003 0 Microsoft Office XP SP3 + Microsoft Excel 2002 SP3 + Microsoft Excel 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft FrontPage 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft Outlook 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft PowerPoint 2002 SP3 + Microsoft Publisher 2002 SP3 + Microsoft Publisher 2002 SP3 Microsoft Office XP SP2 Microsoft Office XP SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2003 SP1 Microsoft Office 2003 0 + Microsoft Excel 2003 + Microsoft FrontPage 2003 + Microsoft InfoPath 2003 + Microsoft OneNote 2003 0 + Microsoft Outlook 2003 0 + Microsoft PowerPoint 2003 0 + Microsoft Publisher 2003 Microsoft MSN Messenger Service 9.0 + Microsoft Picture It! 9.0 + Microsoft Picture It! 9.0 + Microsoft Picture It! Library + Microsoft Picture It! Library Microsoft Internet Explorer 6.0 SP1 Microsoft InfoPath 2003 + Microsoft Office 2003 0 Microsoft Greetings 2002 Microsoft FrontPage 2003 Microsoft FrontPage 2002 SP3 Microsoft FrontPage 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft FrontPage 2002 + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Excel 2003 + Microsoft Office 2003 0 Microsoft Excel 2002 SP3 + Microsoft Office XP SP3 Microsoft Excel 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Excel 2002 SP1 + Microsoft Office XP SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Excel 2002 Microsoft Digital Image Suite 9.0 Microsoft Digital Image Pro 9.0 Microsoft Digital Image Pro 7.0 Microsoft .NET Framework SDK 1.0 SP2 Microsoft .NET Framework SDK 1.0 SP1 Microsoft .NET Framework SDK 1.0 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.0 SP2 Business Objects Crystal Reports 10.0 Business Objects Crystal Reports 9.0 Business Objects Crystal Enterprise 10.0 Business Objects Crystal Enterprise 9.0 Avaya S8100 Media Servers 0 Avaya S3400 Message Application Server 0 + Microsoft Windows 2000 Server Avaya IP600 Media Servers Avaya DefinityOne Media Servers

Not Vulnerable:	Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP2 Microsoft Windows NT Terminal Server 4.0 SP6 Microsoft Windows NT Server 4.0 SP6a + Avaya DefinityOne Media Servers + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 + Avaya S8100 Media Servers 0 Microsoft Windows Messenger 5.1 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Visio 2003 SP1 Microsoft Visio 2000 Enterprise Edition Microsoft Project 2003 SP1 Microsoft Project 2000 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 Microsoft Picture It! Premium 10.0 Microsoft Office 2003 SP1 Microsoft Office 2000 SP3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Office 2000 SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2000 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Office 2000 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Internet Explorer 5.0.1 SP4 - Microsoft Windows 2000 Advanced Server SP4 - Microsoft Windows 2000 Datacenter Server SP4 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Server SP4 Microsoft Internet Explorer 5.0.1 SP3 Microsoft Internet Explorer 5.5 SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows NT Workstation 4.0 Microsoft Digital Image Suite 10.0 Microsoft Digital Image Pro 10.0 Microsoft .NET Framework 1.1 SP1 Microsoft .NET Framework 1.0 SP3

Discussion

Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability

Microsoft (Graphics Device Interface) GDI+ JPEG handler is reported prone to an integer underflow vulnerability when handling JPEG format images. This issue presents itself due to a lack of sufficient sanity checks performed on certain JPEG data before this data employed as a bounds value for a memory copy operation.

A specially crafted JPEG image may trigger this vulnerability and result in the execution of arbitrary attacker-supplied code. Code execution would occur in the context of the user who is running the vulnerable software.

**Update: This issue is similar in nature to BID 1503, discovered by Solar Designer.

** An exploit that opens a command shell on the local vulnerable system as soon as the image is viewed has been released. Symantec has confirmed that this exploit code is functional. It is important to note that this exploit could potentially be modified to execute other code on the system. Administrators should remain vigilant and patch all vulnerable systems.

Exploit / POC

Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability

A proof of concept JPEG that will trigger this issue and crash the affected library is available. It is also reported that the Solar Designer proof of concept 'crash-netscape.jpg' will trigger this vulnerability.

An additional proof of concept exploit 'jpegcompoc.zip' is made available by GulfTech Research.

A script to create a proof of concept JPEG 'ms04-028.sh' is also available.

The 'MSjpegExploitByFoToZ.c' exploit, which opens a command shell on the local system, is available.

An additional exploit, "jfif-expII.sh", with a functional payload has been published. The payload will add user "X" to the Admin group when executed. The exploit is reportedly successful against various versions of GDI+.

A new exploit, "JpegOfDeath.c", is available. It is based on the FoToZ exploit but provides a reverse connection for the command shell.

CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.

/data/vulnerabilities/exploits/CRASH-TEST.zip
/data/vulnerabilities/exploits/crash-netscape.jpg
/data/vulnerabilities/exploits/jpegcompoc.zip
/data/vulnerabilities/exploits/ms04-028.sh
/data/vulnerabilities/exploits/MSjpegExploitByFoToZ.c
/data/vulnerabilities/exploits/jfif-expII.sh
/data/vulnerabilities/exploits/msJPEGParsingVulnHighT1mes.c
/data/vulnerabilities/exploits/JpegOfDeath.c
/data/vulnerabilities/exploits/jpegOfDeathv0_6_a.c
/data/vulnerabilities/exploits/JPGDownloaderATmaCA.c
/data/vulnerabilities/exploits/sacred_jpg.c

Solution / Fix

Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability

Solution:
Microsoft has released a security bulletin MS04-028 and fixes to address this issue in affected products. Additionally, the vendor reports that this issue is addressed in Microsoft Office 2003 Service Pack 1 for Office 2003, Microsoft Visio 2003 Service Pack 1 for Visio 2003 and Microsoft Project 2003 Service Pack 1 for Project 2003.

The vendor also reports that customers that have installed MSN 9, and have chosen to install Picture It! Express version 9 and Picture It! Library, should install the Picture It! version 9 update.

Customers are advised to access the referenced advisory for further information pertaining to obtaining and applying appropriate updates.

Avaya has released an advisory that acknowledges this vulnerability for
Avaya products. Customers are advised to apply the appropriate fix for Microsoft Internet Explorer to the affected Avaya Platforms. Please see the referenced Avaya advisory at the following location for further details:
http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=202196&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()

Microsoft has released a revision to their original advisory. Microsoft Office XP service pack 2 has been reported vulnerable to this issue. The update released for Office XP service pack 3 will patch this issue.

Business Objects has issued fixes for Crystal Reports 9 and 10 and Crystal Enterprise 9 and 10.

Microsoft has updated bulletin MS04-028 to include new fixes for Visual FoxPro 8.0, Visual FoxPro 8.0 Runtime Library, .NET Framework 1.0 Service Pack 2, and .NET Framework 1.1. Additionally, Windows Messenger 5.1 has been released containing a fixed version of the vulnerable library.

Symantec products such as Norton SystemWorks, Norton Password Manager, and Symantec Norton Internet Security Professional do include the affected library but are not prone to this vulnerability since the library is not used to process JPEG images. Nonetheless, updated versions of the library may be obtained through LiveUpdate. Further details may be found in the attached "Symantec Completes Update of Microsoft's Graphic Device Interface Component" advisory.

Microsoft Project 2002 SP1

Microsoft Project 2002 Security Update: KB831931
http://www.microsoft.com/downloads/details.aspx?FamilyId=B3EBCCEA-B0E4 -41C7-A6F4-413864D2CCF3&displaylang=en

Microsoft PowerPoint 2003 0

Microsoft PowerPoint 2003 Add-in: Microsoft Producer for Microsoft Office PowerPoint 2003
http://download.microsoft.com/download/d/3/5/d35a076b-46c3-4f5c-bc2f-a f7e5a82b889/msprod2.exe

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Picture It! Library

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Digital Image Pro 7.0

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Visio 2003

Microsoft Visio 2003 Security Update: KB838345
http://www.microsoft.com/downloads/details.aspx?FamilyId=C07D40A5-6F87 -4D50-9640-34FFD2F189E1&displaylang=en

Microsoft Visio 2003 Service Pack 1
http://www.microsoft.com/downloads/details.aspx?FamilyId=AFCA0578-E1FB -4540-B0CC-FF83DEF61CC6&displaylang=en

Microsoft .NET Framework SDK 1.0

Microsoft .NET Framework 1.0 Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=6978D761-4A92 -4106-A9BC-83E78D4ABC5B&displaylang=en

Microsoft Digital Image Pro 9.0

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Visual Basic .NET Standard 2002

Microsoft Visual Studio .NET 2002 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=44004D19-B22F -4AF2-A701-1FCB0467FBF9&displaylang=en

Microsoft OneNote 2003 0

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Visual C++ .NET Standard 2002

Microsoft Visual Studio .NET 2002 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=44004D19-B22F -4AF2-A701-1FCB0467FBF9&displaylang=en

Microsoft Visual FoxPro 8.0

Microsoft Visual FoxPro 8.0 GDI+ Design-Time Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=A1C5E871-596C -4E33-9EAF-F9A2E4D4DAD0

Microsoft FrontPage 2003

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Visio 2002 Professional SP2

Microsoft Visio 2002 Security Update: KB831932
http://www.microsoft.com/downloads/details.aspx?FamilyId=16C2DFFD-7B73 -43C4-AB0D-2B5EFC80EB63&displaylang=en

Microsoft Visual C# .NET Standard 2003

Microsoft Visual Studio .NET 2003 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=A13B7A21-463C -4286-AD68-E692417E80E2&displaylang=en

Microsoft Outlook 2002 SP3

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Word 2003

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Visual C++ .NET Standard 2003

Microsoft Visual Studio .NET 2003 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=A13B7A21-463C -4286-AD68-E692417E80E2&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

Microsoft Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987
http://download.microsoft.com/download/6/2/8/6281e7a8-5c5b-4c5d-bcd4-9 a29f5211dfe/WindowsServer2003-KB833987-IA64-ENU.EXE

Microsoft PowerPoint 2002 SP2

Microsoft PowerPoint 2003 Add-in: Microsoft Producer for Microsoft Office PowerPoint 2003
http://download.microsoft.com/download/d/3/5/d35a076b-46c3-4f5c-bc2f-a f7e5a82b889/msprod2.exe

Microsoft Publisher 2002 SP3

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Visual J# .NET Standard 2003

Microsoft Visual Studio .NET 2003 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=A13B7A21-463C -4286-AD68-E692417E80E2&displaylang=en

Microsoft Internet Explorer 6.0 SP1

Microsoft Security Update for Internet Explorer 6 Service Pack 1: KB833989
http://www.microsoft.com/downloads/details.aspx?FamilyId=B0095851-674D -4357-868C-DD75D88405EC&displaylang=en

Microsoft Visio 2002 SP2

Microsoft Visio 2002 Security Update: KB831932
http://www.microsoft.com/downloads/details.aspx?FamilyId=16C2DFFD-7B73 -43C4-AB0D-2B5EFC80EB63&displaylang=en

Microsoft Windows Server 2003 Standard Edition

Microsoft Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/download/e/5/9/e5901f37-e33b-433c-9beb-9 f58428c93de/WindowsServer2003-KB833987-x86-ENU.EXE

Microsoft .NET Framework 1.0 SP2

Microsoft .NET Framework 1.0 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?familyid=69703D1D-2CE3 -42DA-ABF8-353D2121DAB0&displaylang=en

Microsoft Visio 2002 Standard SP2

Microsoft Visio 2002 Security Update: KB831932
http://www.microsoft.com/downloads/details.aspx?FamilyId=16C2DFFD-7B73 -43C4-AB0D-2B5EFC80EB63&displaylang=en

Microsoft InfoPath 2003

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Visio 2003 Standard

Microsoft Visio 2003 Security Update: KB838345
http://www.microsoft.com/downloads/details.aspx?FamilyId=C07D40A5-6F87 -4D50-9640-34FFD2F189E1&displaylang=en

Microsoft Picture It! 9.0

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft .NET Framework SDK 1.0 SP2

Microsoft .NET Framework 1.0 Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=6978D761-4A92 -4106-A9BC-83E78D4ABC5B&displaylang=en

Microsoft Picture It! 7.0

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Windows XP Professional

Microsoft Security Update for Windows XP (KB833987)
http://download.microsoft.com/download/a/a/d/aadac1be-dc9d-49a6-945c-7 78409909bcc/WindowsXP-KB833987-x86-ENU.EXE

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

Microsoft Security Update for Windows Server 2003 64-bit Ed. and Windows XP 64-bit Ed, Version 2003 (KB833987
http://download.microsoft.com/download/6/2/8/6281e7a8-5c5b-4c5d-bcd4-9 a29f5211dfe/WindowsServer2003-KB833987-IA64-ENU.EXE

Microsoft Visual C# .NET Standard 2002

Microsoft Visual Studio .NET 2002 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=44004D19-B22F -4AF2-A701-1FCB0467FBF9&displaylang=en

Microsoft Greetings 2002

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft PowerPoint 2002 SP3

Microsoft PowerPoint 2003 Add-in: Microsoft Producer for Microsoft Office PowerPoint 2003
http://download.microsoft.com/download/d/3/5/d35a076b-46c3-4f5c-bc2f-a f7e5a82b889/msprod2.exe

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Picture It! 2002

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Office XP SP3

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Digital Image Suite 9.0

Microsoft Picture It! and Digital Image Security Update - Also includes Greetings 2002
http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B -4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Visual FoxPro Runtime Library 8.0

Microsoft Visual FoxPro 8.0 Runtime Library Update (KB887685)
http://www.microsoft.com/downloads/details.aspx?FamilyId=AEC714BE-9747 -4B57-9967-5F5AC8B8EE87

Microsoft Platform SDK Redistributable: GDI+

Microsoft Platform SDK Redistributable: GDI+
http://download.microsoft.com/download/a/b/c/abc45517-97a0-4cee-a362-1 957be2f24e1/gdiplus_dnld.exe

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?familyid=2A2CD786-CB0F -4946-9D76-D744683BD270&displaylang=en

Microsoft .NET Framework 1.1 Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=A8F5654F-088E -40B2-BBDB-A83353618B38&displaylang=en

Microsoft Office 2003 0

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Office 2003 Service Pack 1
http://www.microsoft.com/downloads/details.aspx?FamilyId=9C51D3A6-7CB1 -4F61-837E-5F938254FC47&displaylang=en

Microsoft Windows XP 64-bit Edition SP1

Microsoft Security Update for Windows XP 64-bit Edition (KB833987)
http://download.microsoft.com/download/1/d/c/1dc38e9f-0fc7-4cf9-8cec-6 b1246aca884/WindowsXP-KB833987-ia64-ENU.EXE

Microsoft Windows Server 2003 Datacenter Edition

Microsoft Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/download/e/5/9/e5901f37-e33b-433c-9beb-9 f58428c93de/WindowsServer2003-KB833987-x86-ENU.EXE

Microsoft Excel 2003

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft FrontPage 2002 SP3

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Visual Studio .NET 2003

Microsoft Visual Studio .NET 2003 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=A13B7A21-463C -4286-AD68-E692417E80E2&displaylang=en

Microsoft Outlook 2003 0

Microsoft Office 2003 Security Update: KB838905
http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9 -4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Excel 2002 SP3

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Visual Basic .NET Standard 2003

Microsoft Visual Studio .NET 2003 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=A13B7A21-463C -4286-AD68-E692417E80E2&displaylang=en

Microsoft Visio 2003 Professional

Microsoft Visio 2003 Security Update: KB838345
http://www.microsoft.com/downloads/details.aspx?FamilyId=C07D40A5-6F87 -4D50-9640-34FFD2F189E1&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

Microsoft Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/download/e/5/9/e5901f37-e33b-433c-9beb-9 f58428c93de/WindowsServer2003-KB833987-x86-ENU.EXE

Microsoft Word 2002 SP3

Microsoft Office XP Security Update: KB832332
http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34 -49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Producer for Microsoft Office PowerPoint

Microsoft Producer for Microsoft Office PowerPoint 2003
http://www.microsoft.com/downloads/details.aspx?FamilyID=1b3c76d5-fc75 -4f99-94bc-784919468e73&DisplayLang=en

Microsoft PowerPoint 2002 SP1

Microsoft PowerPoint 2003 Add-in: Microsoft Producer for Microsoft Office PowerPoint 2003
http://download.microsoft.com/download/d/3/5/d35a076b-46c3-4f5c-bc2f-a f7e5a82b889/msprod2.exe

Microsoft Project 2003

Microsoft Project 2003 Security Update: KB838344
http://www.microsoft.com/downloads/details.aspx?FamilyId=9E37B6B0-A028 -47EA-8FA1-3705877A2908&displaylang=en

Microsoft Project 2003 Service Pack 1
http://www.microsoft.com/downloads/details.aspx?FamilyId=1B04C073-E58F -4F42-B76D-6B565A45CDC3&displaylang=en

Microsoft Windows Server 2003 Web Edition

Microsoft Security Update for Windows Server 2003 (KB833987)
http://download.microsoft.com/download/e/5/9/e5901f37-e33b-433c-9beb-9 f58428c93de/WindowsServer2003-KB833987-x86-ENU.EXE

Microsoft Visual Studio .NET 2002

Microsoft Visual Studio .NET 2002 GDIPLUS.DLL Security Update
http://www.microsoft.com/downloads/details.aspx?FamilyId=44004D19-B22F -4AF2-A701-1FCB0467FBF9&displaylang=en

Microsoft Windows XP Home

Microsoft Security Update for Windows XP (KB833987)
http://download.microsoft.com/download/a/a/d/aadac1be-dc9d-49a6-945c-7 78409909bcc/WindowsXP-KB833987-x86-ENU.EXE

Microsoft PowerPoint 2002

Microsoft PowerPoint 2003 Add-in: Microsoft Producer for Microsoft Office PowerPoint 2003
http://download.microsoft.com/download/d/3/5/d35a076b-46c3-4f5c-bc2f-a f7e5a82b889/msprod2.exe

Business Objects Crystal Enterprise 10.0

Business Objects v10_gdiplus_critical_update.zip
ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/v10_gdiplus _critical_update.zip

Business Objects Crystal Reports 10.0

Business Objects v10_gdiplus_critical_update.zip
ftp://ftp1.businessobjects.com/outgoing/ehf/CriticalUpdate/v10_gdiplus _critical_update.zip

References

Microsoft GDI+ Library JPEG Segment Length Integer Underflow Vulnerability

References:

Buffer overrun vulnerability when processing JPEG images in Crystal products (Business Objects)
GDI Scan (SANS Institute)
JPEG (GDI+) VGX exploit (CORE Security)
Knowledge Base Article - 831931 (Microsoft)
Knowledge Base Article - 831932 (Microsoft)
Knowledge Base Article - 832332 (Microsoft)
Knowledge Base Article - 885876 (Microsoft)
Knowledge Base Article - 885884 (Microsoft)
Knowledge Base Article - 885920 (Microsoft)
Knowledge Base Article - 886988 (Microsoft)
Microsoft Security Bulletin MS04-028 (Microsoft)
Netscape Communicator JPEG-Comment Heap Overwrite Vulnerability (SecurityFocus)
RE: old netscape vuln - affecting XP/explorer? (Ian Webb )
Symantec Completes Update of Microsoft's Graphic Device Interface Component (Symantec)
Microsoft GDIPlus.DLL JPEG Parsing Engine Buffer Overflow ("Nick D." )