Flaw in Microsoft JPEG Parsing

KDan writes "As reported by numerous sources, a new vulnerability has been disclosed (and patched) by Microsoft. This one concerns the parsing of JPEGs in XP Microsoft applications. A buffer overflow can be used to execute arbitrary code. So all those times you told your parents/friends that looking at images was safe - well, not anymore."

If you think looking at images is safe...

...you obviously never saw goatse...

Re:If you think looking at images is safe...

Well, let me try to phrase it as precisely as I can. "It's something that makes a man out of a boy, instantly".

Re:If you think looking at images is safe...

Yes, and that man will require immediate hospitalization and long-term psychotherapy.

Re:If you think looking at images is safe...

What is goatse? Look it up on wikipedia. The entry is goatse.cx. You'll be glad you didn't have to see the image.

Re:If you think looking at images is safe...

http://en.wikipedia.org/wiki/Goatse.cx [wikipedia.org]

Re:If you think looking at images is safe...

See this month's issue of Time [timeinc.net].

Re:If you think looking at images is safe...

THAT is a classic. Thanks for that link.

Note to everyone else, It's safe to click on, but if you don't trust me, just go to time.com and take a look at the cover for the current magazine.

Re:If you think looking at images is safe...

1) Think of Goatse as a "portal".
2) Goatse is a high bandwidth information highway in itself.
3) Goatse can be a hiding place.
4) Goatse tests the limits of humanity.
I ran out of ideas, AC's of the world please fill in the rest...

Why?

If a small company releases a product and people get harmed the lawyers decend like a pack of wolves to sue them.

Why doesn't someone sue Microsoft? After all people sue companies all the time even if the product in question has warning labels.

Re:Why?

because any lawyer that has a chance of winning already works for microsoft

Re:Why?

Uh.. Because losing some data, while sucky, is hardly the same thing as, say, losing an eye? Or your life? Try to put things in some perspective.

Don't you think that a company that sold file cabinets that accidentally shred documents once in a while would be sued?

Re:Why?

Well yea because you wouldn't expect a file cabnet to shred your files.

On the other hand Microsoft spent years conditioning people to belive that computers just randomly shred your files.

Re:Why?

Yeah exactly. When I saw the grandparent post I slapped my forehead. The EULA clearly states that anything bad that happens to you isn't Microsoft's fault. Most software programs have that same clause in their license. If it weren't for that, Microsoft would have been killed by lawsuits years ago.

Other industries don't have that luxury though. An ice cream company can't say put a label saying if you die eating our product we can't be at fault. One reason is that the FDA would go after them. Another reason is nobody would then buy the ice cream. But since it's so common in the software industry, people don't think twice about agreeing to the EULA.

Re:Why?

I think that the kind of people who sue despite warning labels aren't going to be gunning for their OS Vendor (what's an OS? It's the computer's fault!). The average layman uses Occam's Razor to place blame on a computer. If something goes wrong it's most likely that their child did it or the computer is just broken and IBM or Dell is to blame.

EULA's are the reason smarter people don't sue. They exempt the software vendor from an unimaginable amount of liability without the user ever knowing unless they read it.

There appears to be nobody in the third group: the group that understands where the problem is but doesn't understand what EULA's do. They'd be the type to sue.

The 4th group, which understands what an EULA does but doesn't understand how computers work, is likely the group that writes EULA's.

Re:Why?

"Why doesn't someone sue Microsoft? "

Because Microsoft didn't commit the crime. The criminal who used the exploit did. It's fun to suggest things that would get MS in trouble, but if they were sue'able for this, every other product in the world that you like would be in danger, including Linux.

Combined with airpwn.....wow

(Glad I stuck with IE 5.01 sp3 on NT)

Man...talk about attack vectors. This would make a killer (as in bad) worm.

IM
Email
Browsers (probably several)
Anything....heck just copy exploit code to every accessible jpg file on a machine and/or network.

As usual, the writers of the "mitigating factors" section don't seem to have much imagination.

Remember the airpwn project? You could trojan/crack every unpatched machine on a wireless network who pulls up a web browser. And what about those folks who whacked interlands proxies to inject code? Just inject jpgs.

Does anyone know if this can be 'stealth' injected into a JPG (like some of those mp3 issues), or is it standalone exploit code?

WARNING - useless buzzword alert!!!!

The parent post has been flagged for violation of the "Anti Buzzword Use Act". Specific violation: use of the phrase "attack vector". Sanction: exile from use of any computer, writing utensil or paint brush for 10 years.

Aw, c'mon AC, RE: useless buzzword alert!!!!

The parent post has been flagged for violation of the "Anti Buzzword Use Act". Specific violation: use of the phrase "attack vector".

You're right, I should have said "Airpwn could leverage the synergies of this vulnerability and streamline the deployment...with or without interactive buy-in by stakeholders"

Seriously, if you're going to be cute about buzzwords, at least wait until someone uses a real buzzword..."attack vector" is a real term and hasn't reached convergence in the buzzword mindshare yet.

Not the problem

"The vulnerability could only be exploited by an attacker who persuaded a user to open a specially crafted file or to view a directory that contains the specially crafted image," Microsoft said in a statement. "There is no way for an attacker to force a user to open a malicious file."

The problem is not "forcing" people to open attachments, the problem has always been that people open attachments.

Re:Not the problem

Does this also affect JPEG attachments in Outlook?

Lets see....

Ok, check your email now.

Re:Not the problem

Sounds to me like it should be sufficient simply to have a tainted JPEG image on a web page.

Re:Not the problem

The full list of affected programs, from Microsoft's site:

* Windows XP
* Windows XP Service Pack 1 (SP1)
* Windows Server 2003
* Internet Explorer 6 SP1
* Office XP SP3
Note Office XP SP3 includes Word 2002, Excel 2002, Outlook 2002, PowerPoint 2002, FrontPage 2002, and Publisher 2002.
* Office 2003
Note Office 2003 includes Word 2003, Excel 2003, Outlook 2003, PowerPoint 2003, FrontPage 2003, Publisher 2003, InfoPath 2003, and OneNote 2003.
* Digital Image Pro 7.0
* Digital Image Pro 9
* Digital Image Suite 9
* Greetings 2002
* Picture It! 2002 (all versions)
* Picture It! 7.0 (all versions)
* Picture It! 9 (all versions, including Picture It! Library)
* Producer for PowerPoint (all versions)
* Project 2002 SP1 (all versions)
* Project 2003 (all versions)
* Visio 2002 SP2 (all versions)
* Visio 2003 (all versions)
* Visual Studio .NET 2002
Note Visual Studio .NET 2002 includes Visual Basic .NET Standard 2002, Visual C# .NET Standard 2002, and Visual C++ .NET Standard 2002.
* Visual Studio .NET 2003
Note Visual Studio .NET 2003 includes Visual Basic .NET Standard 2003, Visual C# .NET Standard 2003, Visual C++ .NET Standard 2003, and Visual J# .NET Standard 2003.
* .NET Framework 1.0 SP2
* .NET Framework 1.0 SDK SP2
* .NET Framework 1.1
* Platform SDK Redistributable: GDI+

Re:Not the problem

the only reason I had to upgrade to XP is cause I got it for free and was using a pirated copy of 2000. Plus I found it had much better driver and game support than 2000 even though they are basically the same architecture. Go MS, makig 2 almost identical operating systems incompatible with some early drivers....

Re:Not the problem

I would go even further: opening a specially crafted image is automatic if it is inside an HTML page.

How easy would it be to make a website about almost anything and containing one of these babies?

On a sidenote, would Firefox on Windows be vulnerable? Does it use Microsoft's JPEG library or does it have libjpeg embedded?

i knew it!

and i was always telling everyone from the start, download your porn in png format.

Re:i knew it!

Wasn't there a vulnerability in *nix's libpng a short while ago, though?

Microsoft rolls their own buggy JPEG reader...

...Everyone else uses libJPEG.

Any bets on how long it'll be until someone finds either a hole in the Microsoft PNG decoder or libJPEG? We've had holes in libPNG and Microsoft's JPEG decoder.

Personal attack...

I've been telling people for years "no, you can't get a virus from things like a JPEG picture. You're fine."

Now this. Considering how many bugs are reported in all version of MS software, it is entirely possible that there are PERSONAL bugs. "This one is for Charles. Let's fuck with him."

Sigh...

-Charles

Re:Personal attack...

Before that, I told people for years, "No, you can't get a virus from just opening an email". Then the first "outlook virus that spams everyone in your address book" happened.

Is anything safe? Should I start telling people, "No, actually nothing is safe, and you should just not use the computer if you don't want it infected with something nasty".

Or just get them Macs.

Re:Personal attack...

I started using Linux 5 years ago (hello Mozilla M12 :^). This was -just- before the internet went to hell with email viruses, worms, spyware, etc. I've just recently bought a Mac laptop (so quiet! :^), and a big factor was that I don't want to deal with windows (ever. except at work, where they do the whole managed deployment things).

Basically: as difficult as it is to work with Linux (even Debian unstable. Vis: Wireless USB thingies, USB thingies in general, Kernel 2.6 upgrade + CDRom burning, etc), that pain is reduced 999x over by not having to run Ad-aware ever 2 hours, and not having to worry about patching the bug of the month that allows remote-root worms. At work I admin a little Debian-stable server because our IT/Unix department is mostly l4me, and have it set up to cron @daily apt-get "search for security updates" and email to our group. Get about 1-2 every other month, and that's with Known, Old software (provably more secure after every security bugfix). I can't imagine running windows for anything important. It's like being in middle-school with a big "Kick Me" sign taped to your ass.

--Robert

Back in the day

Call me old school, but remember back in the day when opening e-mail was ok, and that executable attachments were what we watched out for? Images were ok, MIDI files were ok, and a bit later, even MP3 files were ok.

Of course if the same codebase were used then, it NEVER was ok...but we sure thought things were juuuust fine.

Is this any way related to the leaked code that led to a vuln discovery regarding BMP files? I know it's a different format but seems like parsing image files spells some trouble.

this isn't the first image exploit

there have been lots of image exploits put out there.

if memory serves there was even a png patch for linux this past summer.

gif exploits have been around for a while too.

the real worry here, as with most M$ security releases is how long they knew about it, and whether they waited until SP2 was released so they could say that their new software didn't have that vulnerability.

microsoft security department, we take orders from marketing!

Re:this isn't the first image exploit

SP2 changed all the core libraries to have protection from buffer overuns hence its not affected.

Re:this isn't the first image exploit

The DEP feature (buffer overrun protection) of XP SP2, or its equivalent in the Linux and BSD worlds, is only available if you are running a K8 based (Athlon 64, Opteron, etc.) processor from AMD. Intel CPUs do not feature hardware-based buffer overrun protection, so this feature is not available on Intel-based x86 systems.

Untrusted data

We're going to get burned over and over and over and then we will get burned some more by processing untrusted data (stuff off the net) using any language that has unsafe memory operations. This isn't just a Microsoft problem; we've seen the same problems in zlib (PNG), resulting in vulnerabilities in almost all Linux/Unix apps that handle graphics. We're going to keep seeing these problems until we start handling all unsafe data as if it's got a contagious disease, which means handling it in an isolated environment like a VM.

---------
WAP [chiralsoftware.net] software

Re:Untrusted data

What'll go a long way to getting rid of buffer overflow exploits is execute-protected memory, which AFAIK AMD currently has, and Intel is playing catch-up to get. Stack/Heap memory is then non-execute enabled, and if you want to do something tricky like generate code on the fly, then you need to get the OS to allocate memory with execute permission set.

Microsoft should give up on IE

They should forget about Internet Explorer and try thier hand on a different line of sofware... ...like, say, e-voting.

Thank god for ASCII pr0n!

Don't worry folks you can still get your pr0n with out getting a social dease...

www.asciipr0n.com [asciipr0n.com]

Pr0n

Who said looking at Pr0n was safe?

Spin Control

From http://www.microsoft.com/technet/security/Bulletin /MS04-028.mspx [microsoft.com]:

In a Web-based attack scenario, an attacker would have to host a Web site that contains a Web page that is used to exploit this vulnerability. An attacker would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's site.

I like the phrase "no way to force users to visit a malicious Web site". How many users have image views enabled in their mail client? How hard would it be for a shady advertiser or a hacked advertiser to include a malicous JPEG as a banner ad?

Pain in the ass to update

While normally I shrug off most Slashdot anti-MS FUD, I've got to admit, this one's going to be a huge pain in the ass to rollout.

Normally, I just read the whitepapers, run a test on a workstation then rollout a Windows update using the free SUS server. This one, I'm going to have to rollout the update (just for XP SP1 users), figure out an update plan for Office, figure out who actually uses those image programs, etc.

And here's a question: SP2 isn't affected. Why didn't they rollout this fix in SP1 *before* rolling out SP2, if they clearly knew it needed fixing. Most companies I know (mine included) are in the middle of testing SP2 migration plans. This adds another wrinkle to the whole process.

Buffer overflows are caused by lazy coders

You don't allocate a buffer of fixed length unless you're lazy. You find out how long the input is, allocate a buffer big enough to fit then move the input to the buffer. When you're done you deallocate the buffer. Simple, safe and easy. I guess Micro$oft coders never learned how to practice safe hex.

Remember the days?

When you tought you couldn't get a virus by opening a document in a word processor?

Microsoft made it possible.

When you assumed you couldn't get attacked by loading a web page?

Microsoft made it possible, too.

When you sweared you couldn't get infected just by receiving e-mail?

Microsoft made it possible, again.

And now, by the very same people who gave you all that...

The JPEG parser vulnerability!!!

God, this company has really brought innovation to the industry!

It just makes me shudder...

... at the horrendous software implementation errors that people are still making in this day and age. *There is no reason for buffer overflows to happen* . Every PC bought in the last five years (at least) is fast enough to bounds check every array / buffer access for all but the most performance-driven applications. Loading a JPEG from a stream is IO-bound enough for bounds checking to be negligible.

From what I read, I gather that buffer overflows account for a large portion of all platform vulnerabilties - Intel & AMD have even implemented a 'no execute' feature in their latest CPUs to go someway to counteract this. I see this as useful, but perhaps overkill - it is *simple* to avoid buffer overflows and the 'no execute' feature could potentially impede devlopment of programs that generate code on the fly (such as Java VMs). The low-level programmers that have been developing C for 20 years just need re-educating. Somebody should tell them computers run at more than 8mhz now...

(That last comment is not meant to be taken too seriously)

This post is only directed towards Todd Walters

Todd Walters, remember 12 years ago in college when I told you that an exploit could theoretically take control of an operating system due to a flaw in the library that renders static graphics? And you said that no, only code that has a chance of executing can lead to exploits?

I Told You So.

BTW if you see this leave me a post, I haven't heard from you in 12 years and I don't know where you are.

Re:This post is only directed towards Todd Walters

I don't know the specifics here, but I can speculate.

They start loading the file and pretty much ask it "How big are you"? The file says something like -1. They then say ok, I need -1 memory so lets allocate -1 memory. They then proceed to turn over "ownership" of the entire computer to the image file. They then ask the file "Ok, so where does the next peice of the picture go?". The file then says "Ohhhh, why don't you clobber the most important thing in memory and put the 'picture' there!". The computer then proceeds to grab its next instruction, which now happens to come from the middle of the 'picture'. It just jumps into the middle of the picture as it it were an EXE file.

There are different variations, the stack, the heap, whatever. But that's the general idea.

In some ways it's really stupid for them to accept insane instructions from the picture like that, but on the other hand it's a semi-common and almost reasonable/lazy error. But no matter how you cut it, it is exactly the sort of thing they should have specifically looked for and it's appalling that they allowed it into the shipping product. They did the same sort of thing with bitmap files, they did the same sort of thing with media player files, the same sort of thing all over the place in reading e-mail files, they did in in gopher, they did it all over the browser, they did it freaking everywhere.

-

Every hole in Windows...

Every hole in Windows seems to constitute the following:

A buffer overflow can be used to execute arbitrary code

...or is that just me?

[OT] Speaking of Parsing JPEGs...

Is there anykind of a browser plug-in I could use to deciper steganographically enhanced JPEG [linux01.gwdg.de] images that might just come over plain old unsuspicious unencrypted http?

GIFs were evil, PNG support lacked transparency, now JPEGs can cause buffer overflows - I'd say that IE has an image problem... Excuse me while I just run away now.

more interesting than you think

Managed code - in this case .NET - is inherently secured against buffer underruns and code injection, until the VM or and the external components used by the framework do not have buffer underrin bugs.

And that's just what happened. .NET Framework is heavily dependent on GDI+. Now you can use a managed software to hack the system.

no way to force you to open a jpeg?

"There is no way for an attacker to force a user to open a malicious file."

This has got to be one of the stupidest things MS has ever said.

It's called spam!!!
99.999% of email programs and browsers automatically "open" images for viewing

We all get spam
the image can be a logo or something nonsuspicious
embedded in the email

So you only have to read the email
to get infected

Re:no way to force you to open a jpeg?

No longer true: after applying SP2, Outlook express by default does NOT show email images.

Michael

Sexy virus

So the next Anna Kournikova virus will actually be a picture of Anna Kournikova

Re:Sexy virus

Sorry but I fail to see a problem with this

Sorry...

On Microsoft products, porn screws YOU!

Source Leak?

A while ago, there was a source leak and someone found a vulnerability in the BMP shell. Is this related to the same thing?

Go No Execute Bit!

If you've got SP2 and an AMD64 chip, this is one great reason to use the no execute bit. I'll assume GDI+ won't mark picture data as executable.

Wow, I mean seriously, wow

Microsoft rates the flaw "important" for many of its products, but "critical" for Outlook versions 2002 and 2003, Internet Explorer 6 with Service Pack 1, Windows XP and Windows XP with Service Pack 1, Windows Server 2003, and the .Net Framework 1.0 with Service Pack 2 and .Net Framework 1.1, according to the Security Bulletin.

Isn't it interesting that when Microsoft is fighting court cases, Internet Explorer is consider "part of the operating system". But in this case they make the distinction between products, so that this flaw is "important" for one piece and "critical" for another.

It's clear to me that Windows, Office and other related Microsoft products are simply unrepairable. And I don't buy that arguement that it's because they've got the biggest market share that these problems are made known. If that's the case, then how come Apache with over 60% of the market and millions of installations is not fraught with as many defects as Microsoft products?

Solution: Microsoft has to open source their code. It will never happen, but they've proven beyond a shadow of a doubt that they can't fix their own code.

Re:Wow, I mean seriously, wow

It's clear to me that Windows, Office and other related Microsoft products are simply unrepairable. And I don't buy that arguement that it's because they've got the biggest market share that these problems are made known. If that's the case, then how come Apache with over 60% of the market and millions of installations is not fraught with as many defects as Microsoft products?

Go compare the number of vulnerabilities in IIS6 and Apache 2, you'll be very surprised.

Re:Wow, I mean seriously, wow

Go to securityfocus.com, they track vulnerabilities reports.

Re:Just plain crappy

Nothing has changed in the way applications are programmed that now allows this to happen. What has happened is that people have just become more skilled in manupulating such situations. The possibilities were always there, it's just been more recent that people have been able to take advantage of them - and made such errors more visible.

SP2 is not affected

Sp2 is not affected. It smells like the new compiler switch avoided the flaw. One more reason to install SP2 to your friends & parents...

I'm sick of this

I haven't run windows at home for 2 years, but I still have to talk to my mom, and her neighbors 1000 miles away cause they have Dell's with XP! regardless of what I've done from here their machines just get overrun with viruses or trojans. I've installed spybot, they have Mccafee running (supposedly) and now this.

I really wish my mom would get broadband so I could install/admin linux from here.

BC

Now I feel somewhat safer

...knowing that my mail client [pc-tools.net] doesn't even load images -- it just strips down all that HTML mess to plaintext. I never trusted pretty emails.

Honestly, looking at something like emails -- what does all this "meta deta" add that isn't available from plain text information content? Want a hyperlink, spell out its URL. Want some lines? Play around with hyphens. It's really not so bad, and so so much less dangerous.

Re:Fair Play

Lets face it ... If the open source community cannot even parse simple PNGS without leaving a security hole why the hell do they claim to be better than Microsoft ?

If you actually knew what you're talking about, you'd know that the JPEG format is definitely not the easiest file format to support, and you'd also know that coding mistakes can happen everywhere, as witnessed daily in the open source community.

So instead of going on an unjustified rant against MS because of something that happen daily everywhere, just chill out.

My mother doesn't think so

She always told me looking at images would make me go blind.

The MS Bulletin

This is real nasty. It looks like most versions of office as well as MS Works since 2000 are affected. See the Security Bulletin [microsoft.com] Any random word document with an infected embeded jpg is a transfer vector.

How dumb can they be

Watch out for next week's critical flaw in MS Hello World.

Meanwhile,

On a completely and totally unrelated topic, does anybody know where I can buy lots of banner ad space in bulk?

Re:Damn It.

Don't trust outside data. Don't developers think of these things?

Of course we think of things but it is never possible to think of every possible scenario when you are punching out applications with hundreds of thousands lines of code. An old college professor of mine once said: "There is no such thing as a perfect programmer. Those that think they are, are either a fool or a liar."

Re:Damn It.

I hope now that png, mp3, and jpg decoders have had vulnerabilities people will be a little more careful in the future.

It isn't necessarily about being careful. If people were that careful about writing all their software, software would take ages to finish writing.

And even then there would still be security flaws. I think the saying about bugs goes something like "Any non-trivial program has at least one bug." I think the same could probably be said for security vulnerabilities.

Sure, we probably shouldn't be seeing buffer overflow exploits anymore considering the amount of attention they have gotten, but it isn't necessarily worth it to go back and review all your code just to find one type of vulnerability when others will be found eventually anyway.

Re:Damn It.

So you really think it's that simple ?
Your code is probably full of security holes, just like everybody's, and the fact that you think it's so simple is a clear evidence...
Look, even Knuth was so certain that his code could not possibly be bugged that he promised a prize for the persons who would find bugs. And still, some were found. And we are talking about a program that was mathematically provable, and made by the living god of computer science, damnit !
And you think that your code, which is sitting on dozens of layers speaking to each others in your back, and made with a high level language, cannot possibly have an unknow bug which could cause a security hole ?
If so, then you're a security hole yourself.

Re:Oh my god

Ohh man I hope the first virus/worm/trojan based on this has is named after an STD.

I was surfing porn and got herpies.

That would be soooo funny.