A local overflow exists in multiple Microsoft products which rely on gdiplus.dll for image processing. The gdiplus.dll fails to validate JPEG image files resulting in a buffer overflow. With a specially crafted image file, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• Security Tracker: 1011253
• Bugtraq ID: 11173
• Secunia Advisory ID: 12528 12671 12702 12772 12990
• ISS X-Force ID: 16304
• CVE ID: 2004-0200 (see also: NVD)
• CERT VU: 297462
• Milw0rm: 472 474 475 478 480 556
• Exploit Database: 472 474 475 478 480 556
• Microsoft Knowledge Base Article: 833987
• Vendor Specific Advisory URL: http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?dlc=en&lc=en&os=228%20&product=90764&lang=en&cc=us&softwareitem=oj-37641-1
  http://www.hitachi-support.com/security_e/vuls_e/HS05-013_e/index-e.html
  http://www.netiq.com/kb/esupport/consumer/solution.asp?id=GUIDa65cb982%5Fa7ef%5F419c%5Fb030%5F124958c284f5&resource=&nShowFacts=&nShowCause=&nShowChange=&nShowAddInfo=&number=1&searchtype=normal&searchclass=&bnewsession=
• Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=109524346729948&w=2
• Packet Storm: http://packetstormsecurity.org/0409-exploits/JpgDownloader.c
  http://packetstormsecurity.org/0409-exploits/ms04-028-cmd.c
  http://packetstormsecurity.org/0409-exploits/ms04-028.sh
• Other Advisory URL: http://support.businessobjects.com/library/kbase/articles/c2016358.asp
  http://www.netobjects.com/support/html/produpnfnof8.html
• Vendor Specific News/Changelog Entry: http://www-01.ibm.com/support/docview.wss?uid=swg21180145
• Microsoft Security Bulletin: MS04-028
• CIAC Advisory: o-213

• Nick DeBaggis - ndebaggisverizon.net -