jeff
Well-known member
Microsoft warns of critical vulnerability in JPEG images
[PC Pro] 10:14
In its September security bulletin Microsoft has highlighted a 'critical' vulnerability in the processing of JPEG images across a huge swathe of its software products. The bulletin says that a specially built JPEG may cause a buffer overrun which will allow an attack to gain control of the machine.
This might raise a few eyebrows. Firstly, although rumours of image-borne viruses pop up quite regularly, they have turned out to be false alarms or you had to click on the image to run the malware. It now turns out that images simply viewed through a whole host of software from Outlook, to Internet Explorer to Word really can carry malicious code.
Secondly, Windows XP Service Pack 2 was supposed to banish buffer overflows in Windows software to the history books and the good news is that copies of Windows XP who have installed Service Pack 2 are safe from attack. The bad news is that Microsoft decided that its image processing should be consistent across all its products. To ensure that, the vulnerable graphics processing module was built into products such as Office XP, Visio 2002, Project 2002, Office 2003, Visio 2003, and Project 2003 so they would run consistently on older versions of the operating system. Therefore users of these products too need to fit a patch.
Microsoft says that no code exploiting the vulnerabilities have been found in the wild
[PC Pro] 10:14
In its September security bulletin Microsoft has highlighted a 'critical' vulnerability in the processing of JPEG images across a huge swathe of its software products. The bulletin says that a specially built JPEG may cause a buffer overrun which will allow an attack to gain control of the machine.
This might raise a few eyebrows. Firstly, although rumours of image-borne viruses pop up quite regularly, they have turned out to be false alarms or you had to click on the image to run the malware. It now turns out that images simply viewed through a whole host of software from Outlook, to Internet Explorer to Word really can carry malicious code.
Secondly, Windows XP Service Pack 2 was supposed to banish buffer overflows in Windows software to the history books and the good news is that copies of Windows XP who have installed Service Pack 2 are safe from attack. The bad news is that Microsoft decided that its image processing should be consistent across all its products. To ensure that, the vulnerable graphics processing module was built into products such as Office XP, Visio 2002, Project 2002, Office 2003, Visio 2003, and Project 2003 so they would run consistently on older versions of the operating system. Therefore users of these products too need to fit a patch.
Microsoft says that no code exploiting the vulnerabilities have been found in the wild
