发布日期：2004-09-14
更新日期：2004-09-20

受影响系统：

Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows 2003

描述：

---

BUGTRAQ  ID: 11173
CVE(CAN) ID: CVE-2004-0200

Microsoft Windows图形设备接口(GDI+)是为用户提供在屏幕和打印机上显示信息的API。GDI+也能处理JPEG图象文件。

GDI+ (Gdiplus.dll)在处理畸形JPEG文件时存在缓冲区溢出，远程攻击者可以利用这个漏洞构建恶意JPEG文件，以用户进程权限在系统上执行任意指令。

Microsoft报告Windows XP、Windows XP Service Pack 1和Windows Server 2003操作系统下的组件存在此问题，由于兼容性问题，部分第三方应用程序安装了这些受影响的组件，包括Office XP, Visio 2002、Project 2002、Office 2003、Visio 2003和Project 2003。如果这些应用程序安装在系统上，并且使用Windows XP、Windows XP Service Pack 1或Windows Server 2003操作系统，用户必须安装此补丁。

必须注意的是第三方的应用程序，只要安装受此漏洞影响的组件，任何应用程序使用Gdiplus.dll处理JPEG图象，就会受到此漏洞攻击。

远程攻击者可以通过构建特殊的JPEG文件，通过WEB连接，EMAIL附件等形式，诱使用户处理，来触发此漏洞。

<*来源：Nick DeBaggis （ndebaggis@verizon.net）
  
  链接：http://www.kb.cert.org/vuls/id/297462
        http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx
*>

建议：

---

厂商补丁：

Microsoft
---------
Microsoft已经为此发布了一个安全公告（MS04-028）以及相应补丁:
MS04-028：Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)
链接：http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

补丁下载：

Microsoft Windows XP and Microsoft Windows XP Service Pack 1：

http://www.microsoft.com/downloads/details.aspx?FamilyId=6F8D70C1-63BD-4213-82C1-20266FDFD735&displaylang=en

Microsoft Windows XP 64-Bit Edition Service Pack 1：

http://www.microsoft.com/downloads/details.aspx?FamilyId=1631C3F7-A40E-4B26-BD92-12141E6A7F58&displaylang=en

Microsoft Windows XP 64-Bit Edition Version 2003：

http://www.microsoft.com/downloads/details.aspx?FamilyId=98BFF681-9703-4D23-8DF8-B7239D6C531C&displaylang=en

Microsoft Windows Server2003：

http://www.microsoft.com/downloads/details.aspx?FamilyId=B2FBD93C-3DC3-4A9E-BDD6-9F39726EE3E2&displaylang=en

Microsoft Windows Server 2003 64-Bit Edition：

http://www.microsoft.com/downloads/details.aspx?FamilyId=98BFF681-9703-4D23-8DF8-B7239D6C531C&displaylang=en

Microsoft Office XP Service Pack 3：

http://www.microsoft.com/downloads/details.aspx?FamilyId=7D128614-6D34-49DF-8D63-6C17E9A2D312&displaylang=en

Microsoft Office XP Service Pack 2：

http://download.microsoft.com/download/B/3/4/B349420C-7D50-4DD0-BFF2-249CF2DB43FA/Officexp-kb832332-fullfile-enu.exe

Microsoft Office XP Software:

Outlook2002

Word 2002

Excel 2002

PowerPoint2002

FrontPage2002

Publisher 2002


Microsoft Office 2003：

http://www.microsoft.com/downloads/details.aspx?FamilyId=106BCF99-1BA9-4035-94C5-2A7FA90E5971&displaylang=en

Microsoft Office 2003 Software

Outlook2003

Word 2003

Excel 2003

PowerPoint2003

FrontPage2003

Publisher 2003

InfoPath2003

OneNote2003


Microsoft Project 2002 Service Pack 1 (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=B3EBCCEA-B0E4-41C7-A6F4-413864D2CCF3&displaylang=en

Microsoft Project 2003 (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=9E37B6B0-A028-47EA-8FA1-3705877A2908&displaylang=en

Microsoft Visio 2002 Service Pack 2 (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=16C2DFFD-7B73-43C4-AB0D-2B5EFC80EB63&displaylang=en

Microsoft Visio 2003 (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=C07D40A5-6F87-4D50-9640-34FFD2F189E1&displaylang=en

Microsoft Visual Studio .NET 2002：

http://www.microsoft.com/downloads/details.aspx?FamilyId=44004D19-B22F-4AF2-A701-1FCB0467FBF9&displaylang=en

Microsoft Visual Studio .NET 2002 Software:

Visual Basic .NET Standard 2002

Visual C# .NET Standard 2002

Visual C++ .NET Standard 2002


Microsoft Visual Studio .NET 2003：

http://www.microsoft.com/downloads/details.aspx?FamilyId=A13B7A21-463C-4286-AD68-E692417E80E2&displaylang=en

Microsoft Visual Studio .NET 2003 Software:

Visual Basic .NET Standard 2003

Visual C# .NET Standard 2003

Visual C++ .NET Standard 2003

Visual J# .NET Standard 2003


The Microsoft .NET Framework version 1.0 SDK Service Pack 2

http://www.microsoft.com/downloads/details.aspx?familyid=6978D761-4A92-4106-A9BC-83E78D4ABC5B&displaylang=en

Microsoft Picture It!2002 (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Greetings 2002：

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Picture It! version 7.0 (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Digital Image Pro version 7.0：

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Picture It! version 9 (all versions, including Picture It! Library)：

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Digital Image Pro version 9

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Digital Image Suite version 9

http://www.microsoft.com/downloads/details.aspx?FamilyId=235EBC80-564B-4B52-A344-502E25AAD7FE&displaylang=en

Microsoft Producer for Microsoft Office PowerPoint (all versions)：

http://www.microsoft.com/downloads/details.aspx?FamilyID=1b3c76d5-fc75-4f99-94bc-784919468e73&DisplayLang=en

Microsoft Platform SDK Redistributable: GDI+：

http://www.microsoft.com/downloads/details.aspx?FamilyId=6A63AB9C-DF12-4D41-933C-BE590FEAA05A&displaylang=en

浏览次数：31700
严重程度：0（网友投票）