10/1 So I downloaded the gdi scan tool from: http://isc.sans.org/gdiscan.php
and it detected a problematic gdiplus.dll for a 3rd party app. How do
I fix it?
\_ Bug the 3rd-party developer to fix it, or be very careful about
viewing untrusted content with that App. If *any* program can view
a 'questionable' JPEG, then the JPEG is not infected. All infected
JPEGS are corrupt.
\_ Well FYI it's Paint Shop Pro 9. Buyer beware.
\_ To give an example of programs where you would least likely expect
GDI+ to be used, I know that QuickBooks actually uses it, and they
haven't replaced the GDIPLUS.DLL yet. In fact, they knew absolutely
NOTHING about this security issue, and I had to IM a former
co-worker there to tell him to get that shit patched ASAP. I'm glad
I got the hell out of there. -phale
\_ I was never too much of a l33t QuickBooks user, but where would
you be opening some arbitrary jpegs with it? Designing a form
layout?
\_ Yah, designing a form layout for an invoice or something. But
you can also download a form layout that somebody else has
created, which will cause QB to open up any JPEGs that have
been embedded inside of that form layout datafile. Granted,
it isn't too likely this would happen, but I've found out the
hard way never to underestimate the stupid things people do
with their computers. -phale
\_ But if the JPEGS are viruses, no benign user could embed
them in the layout file (because it would crash). You'd
need someone to construct a Quickbooks layout file virus.
\_ Actually, no, you could create the file without QB
opening up the JPEG during creation. It just does a
simple copy into another datafile. But when the new
file is opened by another user, the JPEG gets opened up.
Short answer is that is possible, and I actually tried
it already on one of my windoze 2000 boxes. I think I
will leave it at that, as I've probably said way too
much already. -phale
\_ What the hell is Microsoft Ink, and why does it have an unpatched
.dll on my machine?
\_ Who is general failure, and why is he reading my disk!?
\_ It's all the fault of General Protection. |