full-disclosure - SV: Sans GDI scan says still vulnerable after patching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: kruse at krusesecurity.dk (Peter Kruse)
Subject: SV: Sans GDI scan says still vulnerable after patching

Hi Billy,

Copy your updated gdiplus.dll file and overwrite the vulnerable DLL's.
Please note that this procedure might provent third part software from
working proberly.

>F:\WINDOWS\system32\dllcache\sxs.dll

See: http://support.microsoft.com/?kbid=236995

>F:\WINDOWS\system32\sxs.dll

This usally occurs when third part software is installed on the system.
Their DLL's might be based upon the vulnerable version from MS. You shold
make a backup of the vulnerable DLL's and overwite them with the new patched
version. If this doesn't give any problems, with any other software you've
installed, you can always delete the backup.

Regards
Peter Kruse
http://www.csis.dk