Home / malware Exploit:W32/JPG Vulnerability
First posted on 06 August 2010.
Source: SecurityHomeAliases :
There are no other names known for Exploit:W32/JPG Vulnerability.
Explanation :
A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.
Additional DetailsOn September 24th, 2004, a vulnerability which allows code execution was found in Microsoft's GDI+ JPEG decoder (reported in our Lab Weblog). Microsoft posted detailed information on the vulnerability and affected systems in the MS04-028 bulletin:
€ http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx
A proof-of-concept exploit which executes code on the victim's computer when opening a JPG file was posted to a public
website on September 17th, 2004. That exploit only crashed the Internet Explorer web browser.
On September 24th, a constructor appeared that could produce JPG files with the MS04-028 exploit. This time the exploit
executed a code that could download and run a file from Internet. However, the JPG file with the exploit has to be previewed locally for the exploit to get activated; viewing a JPG file from a remote host does not activate the exploit.
On October 12th, 2004, Microsoft released several critical updates for Windows, Exchange and Office, as well as an update for the patch of the JPG vulnerability (MS04-028). Further information and a complete list of updates is available at Microsoft's TechNet Security site:
€ http://www.microsoft.com/technet/security/bulletin/ms04-oct.mspxLast update 06 August 2010
