Microsoft's GDI Detetection Tool faults

Today I downloaded the a gdi+ vulnerability (MS04-028) detection tool published by The SANS. In contraddiction as the report provided by MS gdidettool.exe it found two version of vulnerable dlls.

Be warned don't trust only MS's detection tool! Do all steps to patch your machines.

albatross

P.S. I think this will be another nightmare for many people.... any news about SUS 2.0/WUS?

[Andreas Marx]

Hello!

>I have some things to say to you, and others. Then I will elaborate on
>_yet_another_ JPEG vulnerability.

Yes, it's true that there is another JPEG vulnerability. Anyway, it looks
like a crash bug only (nul pointer reference) which is not exploitable.
There are many ways to crash IE using this problem (with malformed JPEGs).
Microsoft (secure@microsoft.com) is aware of this issue for some months and
according to them, it will be fixed with the next Windows Service Packs
(yes, this means Windows 2000 SP5 and Windows XP SP3).

>I'll reply in the following order: 4. *New* JPEG vulnerability. (Let's
>hype it!)

No, do not hype it!

>Unlike that vulnerability, this one works on SP2 but doesn't seem to be
>exploitable.

Exactly. It is "only" a crash bug -- and many more of these crash bugs
exist in Windows and other operating systems. No need for any kind of hype.

BTW: The current status of AV detection of the MS04-028 issue is (sorted
after product names; including name and status changes, all times in GMT in
the format DD.MM.YYYY HH:MM):

- Antivir 23.09.2004 17:51 "TR/Exploit.MS04-28 (exact)"
- Bitdefender 24.09.2004 14:21 "Exploit.Win32.MS04-028.Gen"
- Dr. Web 21.09.2004 10:51 "Exploit.MS04-028"
- eTrust (CA Engine) 22.09.2004 22:23 "JPEG.MS04-028.Exploit.Trojan"
- eTrust (VET Engine) 23.09.2004 06:38 partly detected as
"JPEG.MS04-028.exploit"
- eTrust (VET Engine) 24.09.2004 06:40 fully detected as
"JPEG.MS04-028.exploit"
- F-Secure 20.09.2004 08:46 "Exploit.Win32.MS04-028.gen"
- Kaspersky 23.09.2004 12:56 "Exploit.Win32.MS04-028.gen"
- McAfee 16.09.2004 23:20 "Exploit-MS04-028" and "Exploit-MS04-028.demo"
- Panda 24.09.2004 13:30 partly detected as "Exploit/MS04-028"
- Symantec 16.09.2004 03:38 partly detected as "Bloodhound.Exploit.13"
- Symantec 18.09.2004 03:42 fully detected as "Bloodhound.Exploit.13" and
"Download.Trojan"
- Trend Micro 18.09.2004 06:10 "Exploit-MS04-028"

For this list, we have tested 29 different products. "Partly detected"
means that only some files out of our testbed are detected right now, but
not all, like some self-generated JPEGs with this exploit. Last update:
Sunday, 26.09.2004, 12:00 h GMT.

More information about this bug, the new JPEG problem, an exploit generator
etc. can be found here in German language:
<http://www.heise.de/newsticker/meldung/51459>

cheers,
Andreas Marx
CEO, AV-Test.org

--
AV-Test GmbH, Klewitzstr. 7, 39112 Magdeburg, Germany
Phone: +49 (0)391 6075466, <http://www.av-test.org>

[Dowling, Gabrielle]

How did you test this (and on what platform), and why do you propose
that the SANS tool is delivering more accurate results than the GDI tool
delivered by Microsoft?

I tested the SANS tool against a properly patched XP system on Friday
and found it to false positive on many of the locations it said it
wouldn't test on. Additionally, I found it to alert on MS09.dll, on an
XP system. Our understanding from Microsoft is that MS09.DLL only needs
to be updated to be fully compatible with an updated GDIPLUS.DLL in the
system directory, it is not directly vulnerable.

So, it would be good to know what you found.

Best,

Gaby



-----Original Message-----
From: albatross@tim.it [mailto:albatross@tim.it]=20
Sent: Friday, September 24, 2004 10:17 AM
To: bugtraq@securityfocus.com
Subject: Microsoft's GDI Detetection Tool faults




Today I downloaded the a gdi+ vulnerability (MS04-028) detection tool
published by The SANS. In contraddiction as the report provided by MS
gdidettool.exe it found two version of vulnerable dlls.



Be warned don't trust only MS's detection tool! Do all steps to patch
your machines.



albatross



P.S. I think this will be another nightmare for many people.... any news
about SUS 2.0/WUS?


************************************************** ********************
This e-mail is sent by a law firm and contains information
that may be privileged and confidential. If you are not the=20
intended recipient, please delete the e-mail and notify us=20
immediately.=20
************************************************** *********************

[the rxmr]

On 27 Sep 2004 17:46:24 -0000, albatross@tim.it <albatross@tim.it> wrote:
> In-Reply-To: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5705D7D30D@nycmb01.l aw.sullcrom.com>
>
> The machine is a Windows XP SP1 completly patched with Office 2000 SP 3 completly patched.
>
> I don't have any kind of imaging programs installed (Photoshop, Picture It, etc)
>
> The output from the SANS tool is:
>
> Scanning...
>
> C:\WINDOWS\$NtServicePackUninstall$\sxs.dll
>
> Version: 5.1.2600.0 <-- Vulnerable version
>
> C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
>
> Version: 5.1.2600.1106 <-- Vulnerable version
>
> C:\WINDOWS\ServicePackFiles\i386\sxs.dll
>
> Version: 5.1.2600.1106 <-- Vulnerable version
>
> C:\WINDOWS\system32\sxs.dll
>
> Version: 5.1.2600.1515
>
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
>
> Version: 5.1.3097.0 <-- Vulnerable version
>
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
>
> Version: 5.1.3101.0 <-- Vulnerable version
>
> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\GdiPlus.dll
>
> Version: 5.1.3102.1360
>
> Scan Complete.
>
> Does anybody know what the content of the WinSxS directory under the windows installation path is?
>
> albatross
>
>
>
>
> >How did you test this (and on what platform), and why do you propose
>
> >that the SANS tool is delivering more accurate results than the GDI tool
>
> >delivered by Microsoft?
>
> >
>
> >I tested the SANS tool against a properly patched XP system on Friday
>
> >and found it to false positive on many of the locations it said it
>
> >wouldn't test on. Additionally, I found it to alert on MS09.dll, on an
>
> >XP system. Our understanding from Microsoft is that MS09.DLL only needs
>
> >to be updated to be fully compatible with an updated GDIPLUS.DLL in the
>
> >system directory, it is not directly vulnerable.
>
> >
>
> >So, it would be good to know what you found.
>
> >
>
> >Best,
>
> >
>
> >Gaby
>
> >
>
>

From an earlier discussion on Bugtraq:

http://lists.sans.org/pipermail/list/2004-September/062106.html

From the page:

"from what I understand the WinSxS folder is a housing area for
shared .dll's to eliminate dll hell."

Here's a couple more links:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sbscs/setup/assembly_searching_sequence.asp

http://www.google.com/search?as_q=&num=10&hl=en&ie=UTF-8&btnG=Google+Search&as_epq=WinSxS&as_oq=&as_eq=&lr=&as_ft=i&as_filetype=&as_qdr=all&as_nlo=&as_nhi=&as_occt=any&as_dt=i&as_sitesearch=&safe=images

--
AH-TAH-HA-NE DI BAH-HAS-TKIH HANE-AL-NEH

In-Reply-To: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5705D7D30D@nycmb01.l aw.sullcrom.com>

The machine is a Windows XP SP1 completly patched with Office 2000 SP 3 completly patched.

I don't have any kind of imaging programs installed (Photoshop, Picture It, etc)

The output from the SANS tool is:

Scanning...
C:\WINDOWS\$NtServicePackUninstall$\sxs.dll
Version: 5.1.2600.0 <-- Vulnerable version
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\ServicePackFiles\i386\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Vulnerable version
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Vulnerable version
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\GdiPlus.dll
Version: 5.1.3102.1360
Scan Complete.


Does anybody know what the content of the WinSxS directory under the windows installation path is?

albatross


>How did you test this (and on what platform), and why do you propose
>that the SANS tool is delivering more accurate results than the GDI tool
>delivered by Microsoft?
>
>I tested the SANS tool against a properly patched XP system on Friday
>and found it to false positive on many of the locations it said it
>wouldn't test on. Additionally, I found it to alert on MS09.dll, on an
>XP system. Our understanding from Microsoft is that MS09.DLL only needs
>to be updated to be fully compatible with an updated GDIPLUS.DLL in the
>system directory, it is not directly vulnerable.
>
>So, it would be good to know what you found.
>
>Best,
>
>Gaby
>

[Scott Jacobson]

First, you should download a newer version of the SANS gdi tool. i had
similar output to yours but mine was a more verbose with it's descriptions.
See below:

Scanning Drive C:...
C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6
SP1 only)
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 5.1.2600.1106 <-- Possibly vulnerable (Backup for uninstall
purposes)
C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8e fd5a9b6f87fff395a2eb989\as
ms\10\msft\windows\gdiplus\gdiplus.dll
Version: 5.1.3102.2180
C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8e fd5a9b6f87fff395a2eb989\sx
s.dll
Version: 5.1.2600.2180
C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8e fd5a9b6f87fff395a2eb989\vg
x.dll
Version: 6.0.2900.2180
C:\WINDOWS\system32\dllcache\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\system32\dllcache\vgx.dll
Version: 6.0.2800.1106 <-- Possibly vulnerable (Win2K SP2 and SP3 w/IE6
SP1 only)
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-w
w_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-
ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Possibly vulnerable (Windows Side-By-Side DLL)
Scan Complete.

The fact that it says, for example, (Win2K SP2 and SP3 w/IE6 SP1 only) next
to several make me feel secure. I'm running XP Pro SP2. I think this is
because the version number is all that the gdi scan is looking. So, it
gives a little more feedback so the user knows if they're still vulnerable
or not.

As per your second question...

COM and Shared DLL Isolation Support

Windows XP has a new folder under Windows called "WinSxS" (Windows
Side-by-Side). This area is used to store versions of Windows XP components
that are built to reduce configuration problems with Dynamic Link Libraries
(DLL) (DLL hell). Multiple versions of components are stored in this folder.
Windows XP allows Win32® API components and applications to use the exact
version of Microsoft components with which they are tested and not be
impacted by other application or operating system updates. It does this by
relying on XML files that contain metadata about application configuration
such as COM classes, interfaces, and type libraries.[1]

Hope that helps.

[1]
http://www.microsoft.com/technet/prodtechnol/winxppro/evaluate/xptechov.mspx

-----Original Message-----
From: albatross@tim.it [mailto:albatross@tim.it]
Sent: Monday, September 27, 2004 1:46 PM
To: bugtraq@securityfocus.com
Subject: Re: Microsoft's GDI Detetection Tool faults


In-Reply-To:
<B7C2C6BA798F3C4DBDD78BEDC1F8AD5705D7D30D@nycmb01.l aw.sullcrom.com>

The machine is a Windows XP SP1 completly patched with Office 2000 SP 3
completly patched.

I don't have any kind of imaging programs installed (Photoshop, Picture It,
etc)

The output from the SANS tool is:

Scanning...
C:\WINDOWS\$NtServicePackUninstall$\sxs.dll
Version: 5.1.2600.0 <-- Vulnerable version
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\ServicePackFiles\i386\sxs.dll
Version: 5.1.2600.1106 <-- Vulnerable version
C:\WINDOWS\system32\sxs.dll
Version: 5.1.2600.1515
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.0.0_x-w
w_8d353f13\GdiPlus.dll
Version: 5.1.3097.0 <-- Vulnerable version
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.10.0_x-
ww_712befd8\GdiPlus.dll
Version: 5.1.3101.0 <-- Vulnerable version
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_65 95b64144ccf1df_1.0.2600.13
60_x-ww_24a2ed47\GdiPlus.dll
Version: 5.1.3102.1360
Scan Complete.


Does anybody know what the content of the WinSxS directory under the windows
installation path is?

albatross


>How did you test this (and on what platform), and why do you propose
>that the SANS tool is delivering more accurate results than the GDI tool
>delivered by Microsoft?
>
>I tested the SANS tool against a properly patched XP system on Friday
>and found it to false positive on many of the locations it said it
>wouldn't test on. Additionally, I found it to alert on MS09.dll, on an
>XP system. Our understanding from Microsoft is that MS09.DLL only needs
>to be updated to be fully compatible with an updated GDIPLUS.DLL in the
>system directory, it is not directly vulnerable.
>
>So, it would be good to know what you found.
>
>Best,
>
>Gaby
>

[mgotts@2roads.com]

> I tested the SANS tool against a properly patched XP system on Friday
> and found it to false positive on many of the locations it said it
> wouldn't test on.

What the FAQ says is that you should ignore the results for certain
directories, not that it won't test them.

"FAQ
Ignore files in directories like Windows\$NtUniinstallKBxxxxx\ and
Windows\WinSxS. These are old versions left behind for uninstal purposes."