CVE-2004-0200

Description

Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.

Affected products

• microsoft / digital_image_pro7.0 – 7.0
• microsoft / digital_image_pro9 – 9
• microsoft / digital_image_suite9 – 9
• microsoft / Excel2003 – 2003
• microsoft / Excel2002 – 2002
• microsoft / frontpage2003 – 2003
• microsoft / frontpage2002 – 2002
• microsoft / greetings2002 – 2002
• microsoft / infopath2003 – 2003
• microsoft / .net_framework1.0 – 1.0
• microsoft / office2003 – 2003
• microsoft / officexp – xp
• microsoft / OneNote2003 – 2003
• microsoft / Outlook2002 – 2002
• microsoft / Outlook2003 – 2003
• microsoft / picture_it7.0 – 7.0
• microsoft / picture_it9 – 9
• microsoft / picture_it2002 – 2002
• microsoft / PowerPoint2002 – 2002
• microsoft / PowerPoint2003 – 2003
• microsoft / producer
• microsoft / project2002 – 2002
• microsoft / project2003 – 2003
• microsoft / publisher2002 – 2002
• microsoft / publisher2003 – 2003
• microsoft / visio2002 – 2002
• microsoft / visio2003 – 2003
• microsoft / visual_basic2002 – 2002
• microsoft / visual_basic2003 – 2003
• microsoft / visual_c++2002 – 2002
• microsoft / visual_c++2003 – 2003
• microsoft / visual_c++2002 – 2002
• microsoft / visual_c++2003 – 2003
• microsoft / visual_j#_.net2003 – 2003
• microsoft / visual_studio_.net2002 – 2002
• microsoft / visual_studio_.net2003 – 2003
• microsoft / windows_2003_serverr2 – r2
• microsoft / windows_xp
• microsoft / windows_xp
• microsoft / windows_xp
• microsoft / windows_xp
• microsoft / Word2003 – 2003
• microsoft / Word2002 – 2002

Exploits & proofs of concept

• exploit-dbMicrosoft Windows - JPEG GDI+ Bind/Reverse/Admin/File Downloadby M4Z3R
• exploit-dbMicrosoft Windows - JPEG GDI+ Remote Heap Overflow (MS04-028)by John Bissell
• exploit-dbMicrosoft Windows - JPEG GDI+ Overflow Download Shellcode (MS04-028)by ATmaCA
• exploit-dbMicrosoft Windows - JPEG GDI+ Overflow Administrator (MS04-028)by Elia Florio
• exploit-dbMicrosoft Windows - JPEG GDI+ Overflow Shellcodeby FoToZ
• exploit-dbMicrosoft Windows - JPEG Processing Buffer Overrun (MS04-028)by perplexy

References

• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3038
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1105
• MISChttp://www.kb.cert.org/vuls/id/297462
• MISChttp://www.us-cert.gov/cas/techalerts/TA04-260A.html
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3320
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2706
• MAILING_LISThttp://marc.info/?l=bugtraq&m=109524346729948&w=2
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1721
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3082
• MISChttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-028
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4003
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3810
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4216
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4307
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3881
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/16304