gdi vulnerability despite Windows update

[JClark]

I ran the Sans version of gdiscan.exe: available at
http://isc.sans.org/gdiscan.php
and it listed several dll files as "vulnerable", including
these, which are not associated with other applications:

C:\WINNT\system32\gdiplus.dll
Version: 5.1.3097.0 <-- Vulnerable version
C:\WINNT\system32\SXS.DLL
Version: 5.1.2600.1106 <-- Vulnerable version
Scan Complete.

But I've updated my win2k/sp4, so I don't see why there should still
be "vulnerable" files in the system folder.

Any advice would be appreciated.

jack

 

[Jim Byrd]

Hi J. Clark - GDIPlusFix seems to work for most folks - Replaces suspect
versions with good ones. http://www.steelbytes.com/?mid=17 Direct DL here:
http://www.magicnotes.com/steelbytes/gdiplus_fix.zip

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[JClark]

Hi J. Clark - GDIPlusFix seems to work for most folks - Replaces suspect
versions with good ones. http://www.steelbytes.com/?mid=17 Direct DL here:
http://www.magicnotes.com/steelbytes/gdiplus_fix.zip

Jim:

Many thanks. I'll download the program and try it. I was able to get a
newer gdiplus.dll from this site (not easy to find):

http://www.microsoft.com/downloads/...9C-DF12-4D41-933C-BE590FEAA05A&displaylang=en

But I haven't been able to find a replacement for my sxs.dll, which is
also labelled "vulnerable".

The steelbytes site looks very interesting. I must investigate it more
thoroughly.

Thanks again.

Jack