Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.

The remote host is running radmin - a remote administration tool - on port 10002. 

This indicates that an attacker may have exploited one of the flaws described in MS04-028 with a widely available exploit. 

As a result, anyone may connect to the remote host and gain control by logging into the remote radmin server.

It was possible to log into the remote host with the login 'X' and a blank password. 

A widely available exploit, using one of the vulnerabilities described in the Microsoft Bulletin MS04-028 creates such an account.  This probably means that the remote host has been compromised by the use of this exploit.

The remote host is running a version of Windows that is vulnerable to a buffer overrun attack when viewing a JPEG file which could allow an attacker to execute arbitrary code on the remote host.

To exploit this flaw, an attacker would need to send a malformed JPEG file to a user on the remote host and wait for him to open it using an affected Microsoft application.

ID	Name	Product	Family	Severity
14834	Radmin (Remote Administrator) Port 10002 - Possible GDI Compromise	Nessus	Backdoors	high
14818	MS04-028 Exploitation Backdoor Account Detection	Nessus	Backdoors	high
14724	MS04-028: Buffer Overrun in JPEG Processing (833987)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2004-0200

high

Tenable Plugins

high

high

high