[36701] in bugtraq
RE: Microsoft's GDI Detetection Tool faults
daemon@ATHENA.MIT.EDU (Dowling, Gabrielle)
Tue Sep 28 04:14:27 2004
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sun, 26 Sep 2004 02:24:17 -0400
Message-ID: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5705D7D30D@nycmb01.law.sullcrom.com>
From: "Dowling, Gabrielle" <dowlingg@sullcrom.com>
To: <albatross@tim.it>, <bugtraq@securityfocus.com>
Content-Transfer-Encoding: 8bit
How did you test this (and on what platform), and why do you propose
that the SANS tool is delivering more accurate results than the GDI tool
delivered by Microsoft?
I tested the SANS tool against a properly patched XP system on Friday
and found it to false positive on many of the locations it said it
wouldn't test on. Additionally, I found it to alert on MS09.dll, on an
XP system. Our understanding from Microsoft is that MS09.DLL only needs
to be updated to be fully compatible with an updated GDIPLUS.DLL in the
system directory, it is not directly vulnerable.
So, it would be good to know what you found.
Best,
Gaby
-----Original Message-----
From: albatross@tim.it [mailto:albatross@tim.it]
Sent: Friday, September 24, 2004 10:17 AM
To: bugtraq@securityfocus.com
Subject: Microsoft's GDI Detetection Tool faults
Today I downloaded the a gdi+ vulnerability (MS04-028) detection tool
published by The SANS. In contraddiction as the report provided by MS
gdidettool.exe it found two version of vulnerable dlls.
Be warned don't trust only MS's detection tool! Do all steps to patch
your machines.
albatross
P.S. I think this will be another nightmare for many people.... any news
about SUS 2.0/WUS?
**********************************************************************
This e-mail is sent by a law firm and contains information
that may be privileged and confidential. If you are not the
intended recipient, please delete the e-mail and notify us
immediately.
***********************************************************************
