Analysis by: Jaime Benigno Reyes
ALIASES:

Exploit:Win32/MS04028!jpeg (Microsoft), Trojan.Mdropper (Symantec), Exp/MS04-028 (Sophos), W32/MS04028.fam!exploit (Fortinet), Exploit.MS04-028028 (Ikarus), Win32/Exploit.MS04-028 trojan (Nod32)

 PLATFORM:

Windows Server 2003, Windows XP (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This is a Trend Micro generic detection for JPEG image files that exploit the MS04-028 vulnerability, which is also known as Buffer Overrun in JPEG Processing (GDI+), to allow code execution in the affected system.

These JPEG image files may be crafted maliciously to contain executable code such that the code is automatically executed when the image files are viewed on vulnerable or unpatched systems. The code may also execute even when the image files are simply previewed as thumbnails. The crafted files may also cause Windows Explorer to crash.

  TECHNICAL DETAILS

File Size: Varies
File Type: JPG, JPEG
Initial Samples Received Date: 17 Sep 2004

NOTES:

This is a Trend Micro generic detection for JPEG image files that exploit the MS04-028 vulnerability, which is also known as Buffer Overrun in JPEG Processing (GDI+), to allow remote code execution of Load Modules/Plugin on the affected system.

These JPEG image files may be crafted maliciously to contain executable code such that the code is automatically executed when the image files are viewed on vulnerable or unpatched systems. The code may also execute even when the image files are simply previewed as thumbnails. The crafted files may also cause Windows Explorer to crash.

Some normal JPEG image files have also been found to crash Windows Explorer inadvertently due to the presence of the JPEG GDI vulnerability. Trend Micro antivirus also generically detects these files, which contain extended "comment" sections that cause the exploit, as EXPL_MS04-028.A.

Visit the following site for more information regarding this vulnerability:

  SOLUTION

Minimum Scan Engine: 9.300
FIRST VSAPI PATTERN FILE: 2.314.03
FIRST VSAPI PATTERN DATE: 17 Sep 2004
VSAPI OPR PATTERN File: 2.315.00
VSAPI OPR PATTERN Date: 20 Sep 2004

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to delete files detected as EXPL_MS04-028.A If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 3

Download and apply this security patch Refrain from using these products until the appropriate patches have been installed. Trend Micro advises users to download critical patches upon release by vendors.


Did this description help? Tell us how we did.