Bugtraq mailing list archives
Re: Microsoft's GDI Detetection Tool faults
From: the rxmr <the.rxmr () gmail com>
Date: Tue, 28 Sep 2004 13:58:24 -0500
On 27 Sep 2004 17:46:24 -0000, albatross () tim it <albatross () tim it> wrote:
In-Reply-To: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5705D7D30D () nycmb01 law sullcrom com> The machine is a Windows XP SP1 completly patched with Office 2000 SP 3 completly patched. I don't have any kind of imaging programs installed (Photoshop, Picture It, etc) The output from the SANS tool is: Scanning... C:\WINDOWS\$NtServicePackUninstall$\sxs.dll Version: 5.1.2600.0 <-- Vulnerable version C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Version: 5.1.2600.1106 <-- Vulnerable version C:\WINDOWS\ServicePackFiles\i386\sxs.dll Version: 5.1.2600.1106 <-- Vulnerable version C:\WINDOWS\system32\sxs.dll Version: 5.1.2600.1515 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Version: 5.1.3097.0 <-- Vulnerable version C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.10.0_x-ww_712befd8\GdiPlus.dll Version: 5.1.3101.0 <-- Vulnerable version C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.1360_x-ww_24a2ed47\GdiPlus.dll Version: 5.1.3102.1360 Scan Complete. Does anybody know what the content of the WinSxS directory under the windows installation path is? albatrossHow did you test this (and on what platform), and why do you proposethat the SANS tool is delivering more accurate results than the GDI tooldelivered by Microsoft?I tested the SANS tool against a properly patched XP system on Fridayand found it to false positive on many of the locations it said itwouldn't test on. Additionally, I found it to alert on MS09.dll, on anXP system. Our understanding from Microsoft is that MS09.DLL only needsto be updated to be fully compatible with an updated GDIPLUS.DLL in thesystem directory, it is not directly vulnerable.So, it would be good to know what you found.Best,Gaby
From an earlier discussion on Bugtraq:
http://lists.sans.org/pipermail/list/2004-September/062106.html
From the page:
"from what I understand the WinSxS folder is a housing area for shared .dll's to eliminate dll hell." Here's a couple more links: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sbscs/setup/assembly_searching_sequence.asp http://www.google.com/search?as_q=&num=10&hl=en&ie=UTF-8&btnG=Google+Search&as_epq=WinSxS&as_oq=&as_eq=&lr=&as_ft=i&as_filetype=&as_qdr=all&as_nlo=&as_nhi=&as_occt=any&as_dt=i&as_sitesearch=&safe=images -- AH-TAH-HA-NE DI BAH-HAS-TKIH HANE-AL-NEH
Current thread:
- Microsoft's GDI Detetection Tool faults albatross (Sep 24)
- <Possible follow-ups>
- Re: Microsoft's GDI Detetection Tool faults John Bissell (Sep 25)
- Re: Microsoft's GDI Detetection Tool faults Gadi Evron (Sep 25)
- Re: Microsoft's GDI Detetection Tool faults Andreas Marx (Sep 27)
- Re: Microsoft's GDI Detetection Tool faults Gadi Evron (Sep 25)
- RE: Microsoft's GDI Detetection Tool faults Dowling, Gabrielle (Sep 27)
- RE: Microsoft's GDI Detetection Tool faults mgotts (Sep 29)
- Re: Microsoft's GDI Detetection Tool faults albatross (Sep 27)
- Re: Microsoft's GDI Detetection Tool faults the rxmr (Sep 28)
- RE: Microsoft's GDI Detetection Tool faults Scott Jacobson (Sep 29)