EXPL_MS04-028.A

This is Trend Micro’s generic detection for JPEG image files that exploit the MS04-028 vulnerability, which is also known as Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution.

These JPEG image files may be crafted maliciously to contain executable code such that the code is automatically executed when the image files are viewed on vulnerable or unpatched systems. The code may also execute even when the image files are simply previewed as thumbnails. The crafted files may also cause Windows Explorer to crash.

Some normal JPEG image files have also been found to crash Windows Explorer inadvertently due to the presence of the JPEG GDI vulnerability. Trend Micro antivirus also generically detects these files, which contain extended "comment" sections that cause the exploit, as EXPL_MS04-028.A.

The impact of the MS04-028 vulnerability lies in the fact that JPEG is one of the most common format for image files.

The MS04-028 vulnerability affects the following components:

Windows platforms:

• Microsoft Windows Server™ 2003
• Microsoft Windows Server 2003 64-Bit Edition
• Microsoft Windows XP
• Microsoft Windows XP Service Pack 1
• Microsoft Windows XP 64-Bit Edition Service Pack 1
• Microsoft Windows XP 64-Bit Edition Version 2003

Applications:

• Digital Image Pro version 9
• Digital Image Suite version 9
• Microsoft .NET Framework, Version 1.0 SDK
• Microsoft Digital Image Pro version 7.0
• Microsoft Greetings 2002
• Microsoft Office System 2003
• Microsoft Office XP Service Pack 3
• Microsoft Picture It!® 2002 (All Versions)
• Microsoft Picture It!® version 7.0 (All Versions)
• Microsoft Picture It!® version 9 (All Versions, including Picture It!® Library)
• Microsoft Producer for Microsoft Office PowerPoint (All Versions)
• Microsoft Project 2002 (All Versions)
• Microsoft Project 2003 (All Versions)
• Microsoft Visio 2002 (All Versions)
• Microsoft Visio 2003 (All Versions)
• Platform SDK Redistributable: GDI+
• Visual Basic .NET Standard 2002
• Visual Basic .NET Standard 2003
• Visual C# .NET Standard 2002
• Visual C# .NET Standard 2003
• Visual C++ .NET Standard 2002
• Visual C++ .NET Standard 2003
• Visual J# .NET Standard 2003
• Visual Studio .NET 2002
• Visual Studio .NET 2003

More information on the MS04-028 vulnerability can be found in the following links:

• MS04-028_JPEG_GDI
• Microsoft Security Bulletin MS04-028

Related Items