This is a preliminary diary, and will be updated throughout the day, as the situation warrants, due to the possibility of a rapidly emerging exploit, or worm, we are releasing this early.

Over the last 24hrs, several exploits taking advantage of the JPEG GDI
vulnerability (MS04-028) have been released. We expect a rapid developemnt
of additional exploits over the next few days.

Tom Liston has put together a scanner, which will scan your systems for vulnerable versions of the GDI libraries you can get it at http://isc.sans.org/gdiscan.php This program should have an MD5 checksum of (91ff45c6158e77eb57fbf6fbe38f05d1)

Several non-microsoft programs include versions of GDI libraries which are vulnerable to exploitation. Using this tool you can identify programs which may be vulnerable, and attempt to obtain updates from the software developer.
SNORT Rules:

Judy Novak sent us these rules developed by the Snort Community.
Snort Rules:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT

JPEG parser heap overflow attempt"; flow:from_server,established;

content:"image/jp"; nocase;

pcre:"/^Content-Type\s*\x3a\s*image\x2fjpe?g.*\xFF\xD8.{2}.*\xFF[\xE1\xE2\xED\xFE]\x00[\x00\x01]/smi";

reference:bugtraq,11173; reference:cve,CAN-2004-0200;

reference:url,www.microsoft.com/security/bulletins/200409_jpeg.mspx;

classtype:attempted-admin; sid:2705; rev:2;)



alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT

JPEG transfer"; flow:from_server,established; content:"image/jp";

nocase; pcre:"/^Content-Type\s*\x3a\s*image\x2fjpe?g/smi";

flowbits:set,http.jpeg; flowbits:noalert;

classtype:protocol-command-decode; sid:2706; rev:1;)



alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT

JPEG parser multipacket heap overflow";

flow:from_server,established; flowbits:isset,http.jpeg; content:"|FF|";

pcre:"/\xFF[\xE1\xE2\xED\xFE]\x00[\x00\x01]/"; reference:bugtraq,11173;

reference:cve,CAN-2004-0200;

reference:url,www.microsoft.com/security/bulletins/200409_jpeg.mspx;

classtype:attempted-admin; sid:2707; rev:1;)

--

Michael Haisley