• info
• discussion
• exploit
• solution
• references

Microsoft GDI+ TIFF File Processing 'BitsPerSample' Tag Remote Code Execution Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.


Microsoft Project 2002 SP1

• Microsoft Security Update for Microsoft Office XP (KB974811)
  http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP (KB958869)
  http://www.microsoft.com/downloads/details.aspx?familyid=e2acde20-a6d3 -4135-b6eb-1214f743d474

Microsoft SQL Server 2005 Itanium Edition SP2

• Microsoft Security Update for SQL Server 2005 Service Pack 2 (KB970895)
  http://www.microsoft.com/downloads/details.aspx?familyid=d971a262-1dfb -498c-a4f3-59fdc1b85d23


• Microsoft Security Update for SQL Server 2005 Service Pack 2 (KB970896)
  http://www.microsoft.com/downloads/details.aspx?familyid=76d3d653-e9a0 -48bc-afae-d3553f7b9235&displaylang=en

Microsoft Report Viewer 2005 SP1

• Microsoft Report Viewer Redistributable 2005 Service Pack 1 GDIPLUS.DLL Security Update (KB971117)
  http://www.microsoft.com/downloads/details.aspx?familyid=0dfaf300-2b53 -4678-a779-0d805ddfe538&displaylang=en

Microsoft Project 2002 0

• Microsoft Security Update for Microsoft Office XP (KB974811)
  http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Expression Web 2

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Office XP SP1

• Microsoft Security Update for Microsoft Office XP (KB974811)
  http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft SQL Server 2005 SP2

• Microsoft Security Update for SQL Server 2005 Service Pack 2 (KB970895)
  http://www.microsoft.com/downloads/details.aspx?familyid=d971a262-1dfb -498c-a4f3-59fdc1b85d23

Microsoft Visual FoxPro 8.0

• Microsoft Visual FoxPro 8.0 Service Pack 1 GDIPLUS.DLL Security Update (KB971104)
  http://www.microsoft.com/downloads/details.aspx?familyid=e5d0d515-4b36 -4025-bc6f-1c5cdf09e1af&displaylang=en

Microsoft Visio 2002 Professional SP2

• Microsoft Security Update for Microsoft Visio 2002 (KB975365)
  http://www.microsoft.com/downloads/details.aspx?familyid=920ee70b-c5c1 -47b5-8f33-938ffe14eea4&displaylang=en

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Windows XP (KB958869)
  http://www.microsoft.com/downloads/details.aspx?familyid=e2acde20-a6d3 -4135-b6eb-1214f743d474

Microsoft Windows XP Media Center Edition SP3

• Microsoft Security Update for Windows XP (KB958869)
  http://www.microsoft.com/downloads/details.aspx?familyid=e2acde20-a6d3 -4135-b6eb-1214f743d474

Microsoft Office 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Report Viewer 2008 0

• Microsoft Report Viewer Redistributable 2008 GDIPLUS.DLL Security Update (KB971118)
  http://www.microsoft.com/downloads/details.aspx?familyid=42ed040f-cf94 -4754-b0b3-c8016fbcbe22&displaylang=en

Microsoft Visio Viewer 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Internet Explorer 6.0 SP1

• Microsoft Security Update for Internet Explorer 6 for Windows 2000 (KB958869)
  http://www.microsoft.com/downloads/details.aspx?familyid=f3fef608-dafb -4b37-a65a-9cc4ae8e2c4c

Microsoft SQL Server 2005 x64 Edition SP1

• Microsoft Security Update for SQL Server 2005 Service Pack 2 (KB970896)
  http://www.microsoft.com/downloads/details.aspx?familyid=76d3d653-e9a0 -48bc-afae-d3553f7b9235&displaylang=en

Microsoft Visio 2002 SP2

• Microsoft Security Update for Microsoft Visio 2002 (KB975365)
  http://www.microsoft.com/downloads/details.aspx?familyid=920ee70b-c5c1 -47b5-8f33-938ffe14eea4&displaylang=en

Microsoft SQL Server 2000 Reporting Services SP2

• Microsoft Security Update for SQL Server Reporting Services 2000 Service Pack 2 (KB970899)
  http://www.microsoft.com/downloads/details.aspx?familyid=33554f96-5af7 -4683-a537-9db293b67b8d

Microsoft Visio Viewer 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Visual Studio .NET 2003 0

• Microsoft Visual Studio .NET 2003 Service Pack 1 GDIPLUS.DLL Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=9e3b52d3-b211 -4d62-891c-ae8f2e4ffc6c&displaylang=en

Microsoft Office XP

• Microsoft Security Update for Microsoft Office XP (KB974811)
  http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Windows XP Tablet PC Edition SP3

• Microsoft Security Update for Windows XP (KB958869)
  http://www.microsoft.com/downloads/details.aspx?familyid=e2acde20-a6d3 -4135-b6eb-1214f743d474

Microsoft PowerPoint Viewer 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Visual FoxPro 9.0 SP1

• Microsoft Visual FoxPro 9.0 Service Pack 2 GDIPLUS.DLL Security Update (KB971105)
  http://www.microsoft.com/downloads/details.aspx?familyid=2a930f56-59ac -49a6-830f-bfae7c540ec7&displaylang=en

Microsoft Office XP SP3

• Microsoft Security Update for Microsoft Office XP (KB974811)
  http://www.microsoft.com/downloads/details.aspx?familyid=b4ac7fbe-dd19 -4940-a576-89a6b7ed602d&displaylang=en

Microsoft Visual FoxPro 9.0 SP2

• Microsoft Visual FoxPro 9.0 Service Pack 2 GDIPLUS.DLL Security Update (KB971105)
  http://www.microsoft.com/downloads/details.aspx?familyid=2a930f56-59ac -49a6-830f-bfae7c540ec7&displaylang=en

Microsoft SQL Server 2005 Itanium Edition SP3

• Microsoft Security Update for SQL Server 2005 Service Pack 3 (KB970892)
  http://www.microsoft.com/downloads/details.aspx?familyid=0d878f4b-71e8 -4170-9a14-1bce684811ce&displaylang=en


• Microsoft Security Update for SQL Server 2005 Service Pack 3 (KB970894)
  http://www.microsoft.com/downloads/details.aspx?familyid=e6f307c1-8b21 -406e-9c6f-b1a3a1e9a98f&displaylang=en

Microsoft Platform SDK Redistributable: GDI+

• Microsoft Platform SDK Redistributable: GDI+ (KB975337)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6A63AB9C-DF12 -4D41-933C-BE590FEAA05A&displaylang=en

Microsoft Visio 2002

• Microsoft Security Update for Microsoft Visio 2002 (KB975365)
  http://www.microsoft.com/downloads/details.aspx?familyid=920ee70b-c5c1 -47b5-8f33-938ffe14eea4&displaylang=en

Microsoft SQL Server 2005 x64 Edition SP3

• Microsoft Security Update for SQL Server 2005 Service Pack 3 (KB970892)
  http://www.microsoft.com/downloads/details.aspx?familyid=0d878f4b-71e8 -4170-9a14-1bce684811ce&displaylang=en


• Microsoft Security Update for SQL Server 2005 Service Pack 3 (KB970894)
  http://www.microsoft.com/downloads/details.aspx?familyid=e6f307c1-8b21 -406e-9c6f-b1a3a1e9a98f&displaylang=en

Microsoft Office 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Visio Viewer 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Office Compatibility Pack 2007 SP1

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en

Microsoft Visual Studio .NET 2003

• Microsoft Visual Studio .NET 2003 Service Pack 1 GDIPLUS.DLL Security Update
  http://www.microsoft.com/downloads/details.aspx?familyid=9e3b52d3-b211 -4d62-891c-ae8f2e4ffc6c&displaylang=en

Microsoft Works 8.5

• Microsoft Security Update for Microsoft Works 8 (KB973636)
  http://www.microsoft.com/downloads/details.aspx?familyid=6f96de9a-62d8 -428f-9567-51d55c129be6

Microsoft Visual Studio 2008 SP1

• Microsoft Visual Studio 2008 Service Pack 1 GDIPLUS.DLL Security Update (KB972222)
  http://www.microsoft.com/downloads/details.aspx?familyid=b904dee8-8a26 -43f8-8ca9-86ad12cfdb52&displaylang=en

Microsoft Office Compatibility Pack 2007 0

• Microsoft Security Update for the 2007 Microsoft Office System (KB972581)
  http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca -4806-a609-453fb29b02ec&displaylang=en