Slashdot Mirror
Flaw in Microsoft JPEG Parsing
KDan writes "As reported by numerous sources, a new vulnerability has been disclosed (and patched) by Microsoft. This one concerns the parsing of JPEGs in XP Microsoft applications. A buffer overflow can be used to execute arbitrary code. So all those times you told your parents/friends that looking at images was safe - well, not anymore."
If a small company releases a product and people get harmed the lawyers decend like a pack of wolves to sue them.
Why doesn't someone sue Microsoft? After all people sue companies all the time even if the product in question has warning labels.
...Everyone else uses libJPEG.
Any bets on how long it'll be until someone finds either a hole in the Microsoft PNG decoder or libJPEG? We've had holes in libPNG and Microsoft's JPEG decoder.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
there have been lots of image exploits put out there.
if memory serves there was even a png patch for linux this past summer.
gif exploits have been around for a while too.
the real worry here, as with most M$ security releases is how long they knew about it, and whether they waited until SP2 was released so they could say that their new software didn't have that vulnerability.
microsoft security department, we take orders from marketing!
---------
WAP software
Before that, I told people for years, "No, you can't get a virus from just opening an email". Then the first "outlook virus that spams everyone in your address book" happened.
Is anything safe? Should I start telling people, "No, actually nothing is safe, and you should just not use the computer if you don't want it infected with something nasty".
Or just get them Macs.
Blaming the victims for opening attachments is silly.
If it's that easy to tell the difference between hostile and benign content, then the differentiation should be done in the application in the first place. If programmers aren't up to doing this, what chance does Joe average user have?
Oh, wait, the programmers did do it, just not the ones that work for M$.
Wouldn't SP2 running an AMD 64bit be safe? I though the No Data Execute feature was supposed to prevent this kinda shit from happening.
Life is not for the lazy.
While normally I shrug off most Slashdot anti-MS FUD, I've got to admit, this one's going to be a huge pain in the ass to rollout.
Normally, I just read the whitepapers, run a test on a workstation then rollout a Windows update using the free SUS server. This one, I'm going to have to rollout the update (just for XP SP1 users), figure out an update plan for Office, figure out who actually uses those image programs, etc.
And here's a question: SP2 isn't affected. Why didn't they rollout this fix in SP1 *before* rolling out SP2, if they clearly knew it needed fixing. Most companies I know (mine included) are in the middle of testing SP2 migration plans. This adds another wrinkle to the whole process.
Before you get too high and mighty, check this article from just 4 days ago.
And that's just what happened. .NET Framework is heavily dependent on GDI+. Now you can use a managed software to hack the system.
If Yoda so strong in Force is, why words in right order he cannot put?
If you've got SP2 and an AMD64 chip, this is one great reason to use the no execute bit. I'll assume GDI+ won't mark picture data as executable.
Nothing has changed in the way applications are programmed that now allows this to happen. What has happened is that people have just become more skilled in manupulating such situations. The possibilities were always there, it's just been more recent that people have been able to take advantage of them - and made such errors more visible.
"You know your god is man-made when he hates all the same people you do."
Or maybe inject one as an Ad somewhere?
Most people don't know how to turn off images in their browsers much less why they would want to do so.
I just found out there's no such thing as the real world. It's just a lie you've got to rise above. - John Mayer
I haven't run windows at home for 2 years, but I still have to talk to my mom, and her neighbors 1000 miles away cause they have Dell's with XP! regardless of what I've done from here their machines just get overrun with viruses or trojans. I've installed spybot, they have Mccafee running (supposedly) and now this.
I really wish my mom would get broadband so I could install/admin linux from here.
BC
free ipod and free gmail!
So you really think it's that simple ?
Your code is probably full of security holes, just like everybody's, and the fact that you think it's so simple is a clear evidence...
Look, even Knuth was so certain that his code could not possibly be bugged that he promised a prize for the persons who would find bugs. And still, some were found. And we are talking about a program that was mathematically provable, and made by the living god of computer science, damnit !
And you think that your code, which is sitting on dozens of layers speaking to each others in your back, and made with a high level language, cannot possibly have an unknow bug which could cause a security hole ?
If so, then you're a security hole yourself.
(See the link in the parent post.)
My first thought was that Time was exposing that Microsoft is behind/inside/running the US government.
Then I read the captions, and it's just something about how our borders are still open. Yeah, we're still the free country. No, our fight against terrorism is losing. Yay, we still have rights. No, we want the government to take those rights away. Yay, bring us your poor and tired, or at least they will be once they start working our overtime crazy schedules. No, I am not reading Time magazine to discover how they slanted it; I'd rather read Slantdot.
But watch out! That image of the magazine cover is a JPEG. Time magazine could be taking over your computer. (Pretending that anybody reading Slashdot is still using MSInternetExplorer.)
I spend my life entertaining my brain.
I am not Todd Walters, but does anyone know
****HOW**** code embedded in the image
gets executed?
No one is giving any technical details.
Toooo much ****NOISE****, not enough ****INFO****.
Real Programmers do make mistakes. However, they don't ship code with great big galloping bugs that a quick code review or many many code analysis tools could have found.
In Knuth's case, he didn't say "I bet $100,000,000,000 that nobody can find a bug!". He created an incentive for people to review his code for bugs. There's a big difference.
This is real nasty. It looks like most versions of office as well as MS Works since 2000 are affected. See the Security Bulletin Any random word document with an infected embeded jpg is a transfer vector.
Isn't it a reasonable assumption, that MSFT is using open source JPEG libraries just like anyone else? Shouldn't we audit libjpeg now, just to be sure?
cpghost at Cordula's Web.