CVE:CVE-2004-0200
CNNVD:CNNVD-200409-064
Microsoft Windows图形设备接口(GDI+)是为用户提供在屏幕和打印机上显示信息的API。GDI+也能处理JPEG图象文件。
GDI+ (Gdiplus.dll)在处理畸形JPEG文件时存在缓冲区溢出，远程攻击者可以利用这个漏洞构建恶意JPEG文件，以用户进程权限在系统上执行任意指令。
Microsoft报告Windows XP、Windows XP Service Pack 1和Windows Server 2003操作系统下的组件存在此问题，由于兼容性问题，部分第三方应用程序安装了这些受影响的组件，包括Office XP， Visio 2002、Project 2002、Office 2003、Visio 2003和Project 2003。如果这些应用程序安装在系统上，并且使用Windows XP、Windows XP Service Pack 1或Windows Server 2003操作系统，用户必须安装此补丁。
必须注意的是第三方的应用程序，只要安装受此漏洞影响的组件，任何应用程序使用Gdiplus.dll处理JPEG图象，就会受到此漏洞攻击。
远程攻击者可以通过构建特殊的JPEG文件，通过WEB连接，EMAIL附件等形式，诱使用户处理，来触发此漏洞。
solution:Upgrade microsoft .net_framework to a higher version than 1.0:sp2,and avoid the version 1.0:sp2; Upgrade microsoft digital_image_pro to a higher version than 7.0,9,and avoid the version 7.0,9; Upgrade microsoft digital_image_suite to a higher version than 9,and avoid the version 9; Upgrade microsoft excel to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft frontpage to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft greetings to a higher version than 2002,and avoid the version 2002; Upgrade microsoft infopath to a higher version than 2003,and avoid the version 2003; Upgrade microsoft office to a higher version than 2003,xp:sp3,and avoid the version 2003,xp:sp3; Upgrade microsoft onenote to a higher version than 2003,and avoid the version 2003; Upgrade microsoft outlook to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft picture_it to a higher version than 7.0,9,2002,and avoid the version 7.0,9,2002; Upgrade microsoft powerpoint to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft producer to a higher version than *:gold,and avoid the version *:gold; Upgrade microsoft project to a higher version than 2002:sp1,2003,and avoid the version 2002:sp1,2003; Upgrade microsoft publisher to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft visio to a higher version than 2002:sp2,2003,and avoid the version 2002:sp2,2003; Upgrade microsoft visual_basic to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft visual_c# to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft visual_c++ to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft visual_j#_.net to a higher version than 2003,and avoid the version 2003; Upgrade microsoft visual_studio_.net to a higher version than 2002:gold,2003:gold,and avoid the version 2002:gold,2003:gold; Upgrade microsoft word to a higher version than 2002,2003,and avoid the version 2002,2003; Upgrade microsoft windows_2003_server to a higher version than r2,and avoid the version r2; Upgrade microsoft windows_xp to a higher version than *,*:gold,*:sp1,and avoid the version *:gold,*:sp1