Re: Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)
From: Russ (Russ.Cooper_at_RC.ON.CA)
Date: 09/15/04
- Previous message: Göran Sedvall: "(GDI+) detection tool don't run without admin prevs."
- Maybe in reply to: Russ Cooper: "Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)"
- Next in thread: Scott Cothrell: "Office update, did it work?"
- Reply: Scott Cothrell: "Office update, did it work?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 15 Sep 2004 08:42:22 -0400 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Here's a couple of points to clear up several messages received;
1. To all those people who keep asking why 833989 appears as an IE update, its because it is. Its the IE version of MS04-028. If you're running an OS which doesn't have an OS version of GDI+ (e.g. Windows 2000), but you have IE 6 installed, WU will download the IE 6 version.
2. Windows XP Gold or XP SP1 *has* an OS version. So you don't need the IE 6 patch on XP, you need the XP patch. I have one report so far from Aras "Russ" Memisyazici who says that applying the XP patch directly to an XP SP1 system reports that its already "applied". Its possible this has to do with the fact that Office on XP uses the XP OS version of GDI+. IOWs, if Office was updated first on an XP Gold or SP1 system, its possible that the OS version of GDI+ was updated, meaning when you then try the XP OS patch, it says its already "applied"...just speculating.
3. So far its been difficult to determine whether WU is actually installing the IE 6 version, or not. I believe it is, but if anyone out there has been to WU (or SUS) with W2K and IE 6 and then run the GDI+ Detection Tool and had it say they needed to update IE (with 833989), let me know.
4. I believe everyone gets the GDI+ Detection Tool.
5. The .Net Framework "patches" aren't, they're new SPs instead.
6. Office should be patched via OfficeUpdate. I'd appreciate hearing from people who have been there (and not just WU). Did it work, didn't it, etc...
Cheers,
Russ - NTBugtraq Editor
-----
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
-----
- Previous message: Göran Sedvall: "(GDI+) detection tool don't run without admin prevs."
- Maybe in reply to: Russ Cooper: "Alert: Microsoft Security Bulletin MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)"
- Next in thread: Scott Cothrell: "Office update, did it work?"
- Reply: Scott Cothrell: "Office update, did it work?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
