> I think Scott and David are just trying to prepare us for the 
> presidential debates.  I think they really were just chatting 
> to each other on the phone and laughing it up and are playing 
> off each other as a combined "publicity stunt."  ;)


Beside some humor that's never wrong, back to the subject line!

Do you know that ANY Internet Explorer is showing each downloaded Jpeg file
BEFORE it's saved to the local cache? So EACH realtime Virusscanner even if
it's able to detect the GDI-Exploit in Jpeg files will catch it to late.

found on the website of the german Federal Office for Information Security
(BSI) 
http://www.bsi.bund.de/av/texte/schwachstelle-jpeg.htm#Update1 (german)


So I suggest instead of writing/reading long discussion about what each
product can/can't do please try to help solve/prevent a big upcoming
problem!
Declude Virus has a build in detection of GDI-Exploits, but as pointed out
some hours ago by different people this feature will catch also legit Jpeg's
send from Macintosh computers. (Well bether a wall to much as less but
certainly something declude users want solved!)



At the moment the only secure way is to patch each single GDI-dll on your
computer(s)!
Even if you're using MXGuard, Declude, 20 Firewalls, 10 intrusion detection
systems and local AV-Scanners!

As I've seen on many systems DON'T TRUST on Microsofts GDI tools.
Even if you've followed anything mentioned on 
http://www.microsoft.com/security/bulletins/200409_jpeg.mspx (BTW: Updated
regulary so keep watching it!)
It's possible that you have vulnerable versions of GDIPLUS.DLL on your
system. 

Many other 3th party applications are using this DLL (for example XARA)

After scanning your system with the tool provided from SANS
http://isc.sans.org/gdiscan.php
you can maybe se a lot more of vulnerable DLLs.

As I know you can ignore warnings for files contained in "$NtUninstall" and
"WinSxS" folders. This should be old versions of the DLL keept only in the
case you want uninstall some patch.


Markus



To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/

Reply via email to