full-disclosure - Sans GDI scan says still vulnerable after patching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: alanme at melmac.co.uk (Alan Melia (Melmac))
Subject: Sans GDI scan says still vulnerable after patching

It looks like the Sans GDI scan does not take into account the PRE-SP1 fix
version...

http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

Windows XP Home Edition, Windows XP Professional, Windows XP Home Edition
Service Pack 1, Windows XP Professional Service Pack 1, Windows XP Tablet PC
Edition, and Windows XP Media Center Edition:

Date         Time   Version        Size       File name     Folder
 
--------------------------------------------------------------------------
   09-Mar-2004  01:58  5.1.2600.136     646,656  Sxs.dll       SP1 (Pre SP1)
   02-Mar-2004  21:19  5.1.3102.1360  1,638,400  Gdiplus.dll   SP1 (Pre SP1)
   09-Mar-2004  02:25  5.1.2600.1363    676,864  Sxs.dll       SP2 (With
SP1)
   02-Mar-2004  21:19  5.1.3102.1360  1,638,400  Gdiplus.dll   SP2 (With
SP1)

Alan

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of BillyBobKnob
Sent: 06 October 2004 16:16
To: Full Disclosure
Subject: [Full-Disclosure] Sans GDI scan says still vulnerable after
patching

I have patched some systems at work with the MS04-028 patch and then ran the
Sans GDI scanner which said that they are still vulnerable.
Any ideas why ?

F:\WINDOWS\system32\dllcache\sxs.dll

Version: 5.1.2600.136 <-- Vulnerable version

F:\WINDOWS\system32\sxs.dll

Version: 5.1.2600.136 <-- Vulnerable version



Thanks
Bill















_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html