Security Firm Finds Program to Create JPEGs Exploiting Microsoft Flaw -- Redmond Channel Partner

Security Firm Finds Program to Create JPEGs Exploiting Microsoft Flaw

By Scott Bekker
October 06, 2004

Panda Software reported finding a tool on black hat hacker sites that can be used to create files in the JPEG image format that exploit the vulnerability in Microsoft's JPEG processing component.

Microsoft patched the flaw on Sept. 14 in security bulletin MS04-028, but because the flaw affects so many products and the patch must be applied to each of the applications on every system, it is a difficult patch to apply.

Officials with Panda Software said the attacker tool, called JPGTrojan.C, allows a user to create several payloads that can be included in the malicious image file. They include payloads to add a new user to the infected computer and grant that user administrative rights, specify a port to be opened to allow remote access to the computer, specify a remote IP address and a port and establish a connection or download an executable file and run it.

The Microsoft bulletin is available here.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

Microsoft Dismantles RedVDS Cybercrime Marketplace Linked to $40M in Phishing Fraud

In a coordinated action spanning the United States and the United Kingdom, Microsoft’s Digital Crimes Unit (DCU) and international law enforcement collaborators have taken down RedVDS, a subscription based cybercrime platform tied to an estimated $40 million in fraud losses in the U.S. since March 2025.
CrowdStrike's Acquisition of SGNL Aims to Strengthen Identity Security

CrowdStrike signs definitive agreement to purchase SGNL, an identity security specialist, in a deal valued at about $740 million.
Microsoft Acquires Osmos, Automating Data Engineering inside Fabric

In a strategic move to reduce time-consuming manual data preparation, Microsoft has acquired Seattle-based startup Osmos, specializing in agentic AI for data engineering.
Linux Foundation Unites Major Tech Firms to Launch Agentic AI Foundation

The Linux Foundation today announced the creation of a new collaborative initiative — the Agentic AI Foundation (AAIF) — bringing together major AI and cloud players such as Microsoft, OpenAI, Anthropic and other major tech companies.