Re: Microsoft's GDI Detetection Tool faults

[John Bissell]

In-Reply-To: <20040924141725.13699.qmail@www.securityfocus.com>

>Received: (qmail 18580 invoked from network); 25 Sep 2004 02:57:58 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26)
> by mail.securityfocus.com with SMTP; 25 Sep 2004 02:57:58 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing2.securityfocus.com (Postfix) with QMQP
> id 43EBF1464F4; Fri, 24 Sep 2004 10:24:36 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 13030 invoked from network); 24 Sep 2004 08:08:27 -0000
>Date: 24 Sep 2004 14:17:25 -0000
>Message-ID: <20040924141725.13699.qmail@www.securityfocus.com>
>Content-Type: text/plain
>Content-Disposition: inline
>Content-Transfer-Encoding: binary
>MIME-Version: 1.0
>X-Mailer: MIME-tools 5.411 (Entity 5.404)
>From: <albatross@tim.it>
>To: bugtraq@securityfocus.com
>Subject: Microsoft's GDI Detetection Tool faults
>
>
>
>Today I downloaded the a gdi+ vulnerability (MS04-028) detection tool published by The SANS. In contraddiction as the report provided by MS gdidettool.exe it found two version of vulnerable dlls.
>
>Be warned don't trust only MS's detection tool! Do all steps to patch your machines.
>
>albatross
>
>P.S. I think this will be another nightmare for many people.... any news about SUS 2.0/WUS?
>

MicroSoft's detection tool is is almost worthless. I used that after finding out about the new GDI+ security hole and it reported very vague dumb information. Like "You may have a problem" then I installed the lame patch they oringally provided on the fir
st day they reported the issue and I ran the detection tool again and it said the same thing! I haven't tried the SANS detection tool yet but I bet it is much much better then what I used with the MS detection tool. I can't believe how long it took MS to
patch this issue (about a year!!!) and they still were not ready when they went public with how to fix the issue.

I predict there is going to be a major worm just around the corner exploiting the new GDI+ JPEG vulnerability... Now that a bunch of example exploits with "insert your shellcode here" have been posted it's only a matter of time before someone has the guts
/ego to try to pull off a major worm taking advantage of this issue...

To all the people out there who found out about this security problem as soon as MS posted about it (which I'm sure is a lot of people since the media covered the issue all over). Then I hope you guy's check Windows Update again for any patchs regarding t
he GDI+ JPEG issue because I learned about it right about when MS released the original patch and visited there site to download the patch which didn't really fix the problem.. Then about two weeks later I went back to Windows Update to see if there was a
nything new and they did actually post a good patch to really fix the problem..

So I'm betting there are people like me who thought they were patched after installing the patch provided on MS's website but didn't know there was anything new patchs regarding the GDI+ JPEG vulnerablity issue on Windows Update. Everyone better start get
ting the good patch soon before the new Sasser worm begins to spread! It's only a matter of time...

--HighT1mes

[Gadi Evron]

> Everyone better start getting the good patch soon before the new Sasser worm begins to spread! It's only a matter of time...

I have some things to say to you, and others. Then I will elaborate on
_yet_another_ JPEG vulnerability.

I'll reply in the following order:
1. Patches are good.
2. Doomsday worms.
3. Media hype.
4. *New* JPEG vulnerability.
(Let's hype it!)

Although installing patches and checking for new patches is sound
advice, and although this vulnerability has potential for harm, I just
don't get it.

Why go around spreading fear of a "doomsday worm"? If a worm shows up,
it will. The social engineering risk of this vulnerability is
considerably higher/easier than that of others in the past. Yet, there
were similar vulnerabilities that ended up not "working out" for the bad
guys.

Are "viruses" as a group going to employ this? Absolutely. I am positive
of that fact.

Is it going to be huge? It might, I just don't see any reason to commit
to it. It might just as simply be forgotten by next month's MS security
patch release.

Picking out one security issue a month and hyping it is bad policy, and
I wish security experts would stop playing along with the media on this.

Unlike some other vulnerabilities, this one is relatively easy to cope
with in a "virus scan". Although compressed and thus problematic, the
JPEG format is very orderly and simple. Any tampered JPEG would be
discovered from a distance if somebody just looked.

AV and IDS tools detect it, and people download the patches. That's good
enough and as good as anything we can do.

Those who do not install, update and use an AV, or fail to install
patches will fall, as they always do. But how is that different than
with any other worm?

Malware will appear that will use this, and in fact - a creation kit
already appeared this Friday, but please.. please.. I beg of you (not
you specifically) - stop the media hype of the situation.

People should be aware of the risks, protect themselves and not believe
everything they see online. Throwing populations into a fit over this
worm or that may be profitable, but it sure as hell won't solve the main
issues.
That's all just wishful thinking, though.

There was a second problem with JPEGs, discovered by Maik Morgenstern,
AV-Test.org.
They found a picture that was tampered to kill IE, different from the
problem disclosed in MS04-028 and discovered a year ago (!!).

(a year.. makes you wonder, did they wait to release SP2 and what else
is waiting for us that miraculously doesn't effect SP2?).

Unlike that vulnerability, this one works on SP2 but doesn't seem to be
exploitable.

According to AV-Test.org/de, this was found in-the-wild. I am not their
spokesman, although I am rather enthusiastic about their work. I only
wish to stress the point that there is life beyond the monthly media-pick.

Gadi Evron.