Published: 28/09/2004 Updated: 30/10/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 960

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote malicious users to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft .net framework 1.0
microsoft frontpage 2003
microsoft greetings 2002
microsoft picture it 2002
microsoft picture it 7.0
microsoft publisher 2003
microsoft visio 2002
microsoft visual c\\+\\+ 2003
microsoft visual j\\# .net 2003
microsoft excel 2003
microsoft frontpage 2002
microsoft outlook 2002
microsoft outlook 2003
microsoft project 2002
microsoft project 2003
microsoft publisher 2002
microsoft visual c\\# 2003
microsoft visual c\\+\\+ 2002
microsoft digital image suite 9
microsoft excel 2002
microsoft office xp
microsoft onenote 2003
microsoft powerpoint 2003
microsoft producer
microsoft visual basic 2003
microsoft visual c\\# 2002
microsoft word 2002
microsoft word 2003
microsoft digital image pro 7.0
microsoft digital image pro 9
microsoft infopath 2003
microsoft office 2003
microsoft picture it 9
microsoft powerpoint 2002
microsoft visio 2003
microsoft visual basic 2002
microsoft visual studio .net 2002
microsoft visual studio .net 2003
microsoft windows 2003 server r2
microsoft windows xp

/* =============================================================== Windows JPEG GDI+ Overflow Download Shellcoded Exploit (MS04-028) Coded By ATmaCA Credit to eEye Digital Security,K-OTik Security,FoToZ,pathetic E-Mail:atmaca@prohacknet Web:wwwprohacknet =============================================================== */ #include <windowsh& ...

#!/bin/sh # # MS04-028 Exploit PoC II with Shellcode: CreateUser X in Administrators Group # # Tested on: # WinXP Professional English SP1 - GDIPLUSDLL version 5130970 # WinXP Professional Italian SP1 - GDIPLUSDLL version 5131010 # (SP2 is not vulnerable, don't waste your time trying this exploit on it!) # # Usage: # first, replace the ...

/* * Exploit Name: * ============= * JpegOfDeathMc v06a All in one Bind/Reverse/Admin/FileDownload * ============= * Tweaked Exploit By M4Z3R For GSO * All Credits & Greetings Go To: * ========== * FoToZ, Nick DeBaggis, MicroSoft, Anthony Rocha, #romhack * Peter Winter-Smith, IsolationX, YpCat, Aria Giovanni, * Nick Fitzgerald, Adam Nan ...

#!/bin/sh # # The JPEG vuln is triggered by the 0 or 1 length field with an integer flaw # The crafted JPEG header makes Windows crash a couple of different ways # 1) First, it crashes when the image is opened # 2) Second, it crashes when hovering the mouse over the image # # The pointer overwrite is pretty straight forward in a debugger # # Usag ...

/*************************************************************** * * GDI+ JPEG Remote Exploit * By John Bissell AKA HighT1mes * * Exploit Name: * ============= * JpegOfDeathc v05 * * Date Exploit Released: * ====================== * Sep, 23, 2004 * * Description: * ============ * Exploit based on FoToZ exploit but kicks the ...

// launch a local cmdexe (not bound to the net) // GDI+ buffer overrun exploit by FoToZ // NB: the headers here are only sample headers taken from a JPG file, // with the FF FE 00 01 inserted in header1 // Sample shellcode is provided // You can put approx 2500 bytes of shellcodewho needs that much anyway // Tested on an unpatched WinXP S ...

CVE-2004-0200

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect