RE: Microsoft's GDI Detetection Tool faults

From: Dowling, Gabrielle (dowlingg_at_sullcrom.com)
Date: 09/26/04

  • Next message: Mike Healan: "Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes" 
    Date: Sun, 26 Sep 2004 02:24:17 -0400
To: <albatross@tim.it>, <bugtraq@securityfocus.com>

    How did you test this (and on what platform), and why do you propose
    that the SANS tool is delivering more accurate results than the GDI tool
    delivered by Microsoft?

    I tested the SANS tool against a properly patched XP system on Friday
    and found it to false positive on many of the locations it said it
    wouldn't test on. Additionally, I found it to alert on MS09.dll, on an
    XP system. Our understanding from Microsoft is that MS09.DLL only needs
    to be updated to be fully compatible with an updated GDIPLUS.DLL in the
    system directory, it is not directly vulnerable.

    So, it would be good to know what you found.

    Best,

    Gaby

    -----Original Message-----
    From: albatross@tim.it [mailto:albatross@tim.it]
    Sent: Friday, September 24, 2004 10:17 AM
    To: bugtraq@securityfocus.com
    Subject: Microsoft's GDI Detetection Tool faults

    Today I downloaded the a gdi+ vulnerability (MS04-028) detection tool
    published by The SANS. In contraddiction as the report provided by MS
    gdidettool.exe it found two version of vulnerable dlls.

    Be warned don't trust only MS's detection tool! Do all steps to patch
    your machines.

    albatross

    P.S. I think this will be another nightmare for many people.... any news
    about SUS 2.0/WUS?

    **********************************************************************
    This e-mail is sent by a law firm and contains information
    that may be privileged and confidential. If you are not the
    intended recipient, please delete the e-mail and notify us
    immediately.
    ***********************************************************************

  • Next message: Mike Healan: "Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes"

    Relevant Pages

    • Re: Microsofts GDI Detetection Tool faults
      ... > Does anybody know what the content of the WinSxS directory under the windows installation path is? ... >>that the SANS tool is delivering more accurate results than the GDI tool ... >>system directory, ...
      (Bugtraq)
    • Re: Microsofts GDI Detetection Tool faults
      ... I don't have any kind of imaging programs installed (Photoshop, Picture It, etc) ... The output from the SANS tool is: ... >that the SANS tool is delivering more accurate results than the GDI tool ... Our understanding from Microsoft is that MS09.DLL only needs ...
      (Bugtraq)