Homestead mailing list

[Tvoivozhd <tvoivozd AT infionline.net>]

Robert Vamosi           
*Why you should switch to Firefox now*

*Robert Vamosi* 
<http://reviews-zdnet.com.com/AnchorDesk/Vamosi/4620-6033_16-4000023.html?tag=byline> 

Senior Editor, Reviews
Friday, Sept. 24        
TalkBack!Add your opinion 
<http://reviews-zdnet.com.com/AnchorDesk/4520-7297_16-5515208.html#talkback> 


Forward in E-mail this story! 
<http://reviews-zdnet.com.com/AnchorDesk/4640-7297_16-5515208.html?tag=email> 
Format for Printer 
<http://reviews-zdnet.com.com/AnchorDesk/4630-7297_16-5515208.html?tag=print> 


Can you imagine the Internet without pictures? A new flaw in the way 
Windows, and therefore Internet Explorer, renders JPEG images--one of 
the most common image formats on the Web--should make you think twice 
about whether you should display them. At the very least, it should 
nudge you into considering an alternative Internet browser, such as 
Firefox 
<http://reviews-zdnet.com.com/Mozilla_Firefox_10PR/4505-9241_16-31117280.html?tag=txt>. 
The code to exploit this flaw 
<http://news.com.com/Code+to+exploit+Windows+graphics+flaw+now+public/2100-1002_3-5378260.html?tag=txt> 
is now public. Usually, exploit code release is the first step toward a 
new virus or worm, and as we have seen before, the time from exploit to 
virus is generally two to three weeks. In other words, the clock is 
ticking. *The GDIplus vulnerability, in a nutshell*
If you use a Windows operating system older than Windows 2000 or have 
already updated to Windows XP SP2, you're immune to the flaw. There are 
many ways to render JPEGs, but the Graphic Device Interface plus DLL, or 
gdiplus.dll, is enabled only in Windows 2000 and Windows XP. Because the 
gdiplus.dll is vulnerable to a buffer overflow attack, malicious code 
lurking inside an infected JPEG file could allow new, potentially 
malicious code to take over the use of your computer (or, at the very 
least, crash it). Unfortunately, the apps that run in Windows 2000 and 
XP are also vulnerable. *Microsoft Office is vulnerable*
# The list of these vulnerable apps is not short and includes: Microsoft 
.Net Framework 1./x/
# Picture It Digital Image Pro 7./x/ 
<http://reviews-zdnet.com.com/Microsoft_Picture_It_Digital_Image_Pro_70/4505-3634_16-20255720.html?tag=txt>  
and 9./x/ 
# Digital Image Suite 9./x/ 
<http://reviews-zdnet.com.com/Microsoft_Digital_Image_Suite_90/4505-3634_16-30472054.html?tag=txt>
# FrontPage 2002 
<http://reviews-zdnet.com.com/Microsoft_FrontPage_2002_Win98MENT42K/4505-3637_16-5600609.html?tag=txt>
# Greetings 2002
# Internet Explorer 6.0 
<http://reviews-zdnet.com.com/Microsoft_Internet_Explorer_60/4505-3513_16-20832430.html?tag=txt>
# Office 2003 Professional Edition 
<http://reviews-zdnet.com.com/Microsoft_Office_2003_Professional/4505-3524_16-30536957.html?tag=txt>
# Office 2003 Small Business Edition, 
<http://reviews-zdnet.com.com/Microsoft_Office_Small_Business_Edition_2003/4505-3524_16-30536959.html?tag=txt>
# Office 2003 Standard Edition 
<http://reviews-zdnet.com.com/Microsoft_Office_Standard_Edition_2003/4505-3524_16-30536954.html?tag=txt>
# Office 2003 Student and Teacher Edition 
<http://reviews-zdnet.com.com/Microsoft_Office_Student_and_Teacher_Edition_2003/4505-3524_16-30581832.html?tag=txt>
# Office XP 
<http://reviews-zdnet.com.com/Microsoft_Office_XP/4505-3524_16-5152705.html?tag=txt>
# Outlook 2003 
<http://reviews-zdnet.com.com/Microsoft_Office_Outlook_2003/4505-3536_16-30538978.html?tag=txt> 
and 2002
# Picture It 2002 
<http://reviews-zdnet.com.com/Microsoft_Picture_It_Publishing_Platinum_2002/4505-3634_16-6630514.html?tag=txt>, 
7./x,/  and 9./x/
# PowerPoint 2002 and PowerPoint 2003 
<http://reviews-zdnet.com.com/Microsoft_Office_PowerPoint_2003/4505-3525_16-30511144.html?tag=txt>
# Project 2002 
<http://reviews-zdnet.com.com/Microsoft_Project_Standard_2002/4505-3526_16-20042858.html?tag=txt> 
and Project 2003 
<http://reviews-zdnet.com.com/Microsoft_Office_Project_2003/4505-3526_16-30534938.html?tag=txt>
# Publisher 2002 
<http://reviews-zdnet.com.com/Microsoft_Publisher_2002_Win98MENT42K/4505-3628_16-5599921.html?tag=txt>
# Visio 2002, Visio 2003 
<http://reviews-zdnet.com.com/Microsoft_Office_Visio_2003/4505-3525_16-30534932.html?tag=txt>
# Visual Studio .Net 2002 and 2003
# Word 2002 
<http://reviews-zdnet.com.com/Microsoft_Word_2002_Win98ME2K/4505-3529_16-5578235.html?tag=txt> 

Now, what happens if you patch your system with Windows XP SP2, then 
load one of the above apps? Believe it or not, the potential exists for 
that app to overwrite the patched gdiplus.dll with an older, more 
vulnerable version. You can see what a nightmare this has become 
already. Thus, Microsoft has posted a free online tool 
<http://dw.com.com/redir?oid=4520-7297_16-5515208&edid=7297&siteid=16&edid=2&lop=txt&destcat=microsoft&destUrl=http%3A%2F%2Fwww%2Emicrosoft%2Ecom%2Fsecurity%2Fbulletins%2F200409%5Fjpeg%5Ftool%2Emspx> 
to assess the current vulnerability of your computer. What if you don't 
use Microsoft apps on your Windows computer? Surprisingly, your solution 
might be even more complicated. *Macromedia products not vulnerable*
Some non-Microsoft apps, such as those from Macromedia, also regularly 
use JPEG files. Turns out, some Macromedia apps do install the 
vulnerable gdiplus.dll, but they actually use the Microsoft graphics 
library instead to process JPEGs. That means products such as Macromedia 
Contribute, Dreamweaver, Fireworks, Flash, Flashpaper, FreeHand, 
RoboSource Control, and Studio MX are not affected by the GDI flaw. 
Nonetheless, if you do load any of these apps after you've patched your 
system, make sure they don't overwrite the patched version of 
gdiplus.dll. To find out more about software vulnerability to this flaw, 
see this US-CERT 
<http://dw.com.com/redir?oid=4520-7297_16-5515208&edid=7297&siteid=16&edid=2&lop=txt&destcat=cert&destUrl=http%3A%2F%2Fwww%2Ekb%2Ecert%2Eorg%2Fvuls%2Fid%2F297462> 
document for more details. *Microsoft: Upgrade to Windows XP or else*
In a separate but related development, Microsoft announced that future 
security enhancements for its Internet Explorer 
<http://news.com.com/Microsoft+to+secure+IE+for+XP+only/2100-1032_3-5378366.html?tag=nefd.lede> 
will be available through its Windows XP update service only. By 
refusing to offer separate security enhancements for Internet Explorer, 
which is the main vector for any JPEG-related worm or virus, Microsoft 
is essentially saying that anyone who hasn't yet upgraded to Windows XP 
won't be protected from future exploits. The average cost to upgrade to 
Windows XP is about $99; you do the math. *Firefox is a start but not 
the whole solution*
If you've taken my past advice, you've already bailed on Internet 
Explorer and installed Mozilla Firefox 
<http://reviews-zdnet.com.com/Mozilla_FireFox_10PR/4505-9241_7-31117280.html> 
as your default Internet browser. For the most part, you can avoid the 
JPEG flaw, right? Wrong. Because Microsoft bundles IE deep within 
Windows, you can't avoid IE by not using it. For example, say you get an 
HTML e-mail message from someone that includes a JPEG image. If you're 
using Outlook 2002 or earlier, it calls on IE to render that image. The 
same is true for Microsoft Word and other Office apps that offer a Web 
view. Outlook 2003 at least gives you the option of viewing an image or 
not, but should you choose to view it, Outlook 2003 will still call IE. 
You can remove Internet Explorer from Windows, but it would take a 
column twice as long as this to cover all the Registry settings and such 
you'd need to tweak to do so.