WelcomeEnterpriseSmall BusinessHome & Home OfficePartnersAbout Symantec
January 18, 2005
Symantec Completes Update of Microsoft's Graphic Device Interface Component (gdiplus.dll)

Revision History

Risk Impact
The Symantec installed gdiplus.dll is not used in a vulnerable manner by affected Symantec products.

Affected Components
Symantec Norton SystemWorks 2003, 2004, 2005
Symantec Norton Password Manager 2004
Symantec Norton Internet Security Professional 2003, 2004

Non-Affected Components
All Symantec products not specifically identified above

Reference Microsoft Security Bulletin MS04-028, Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution. Symantec did a thorough review of all products that install a Symantec version of the gdiplus.dll when this vulnerability was initially identified.

Of particular importance to Symantec products and Symantec customers is the portion of the MS04-028 bulletin that states "Not every program that installs this file is vulnerable to this issue because it may not use the gdiplus.dll file to process JPEG images. Even when the third-party application uses the gdiplus.dll file to process JPEG images it may not do so in a vulnerable way. For example if an application does not allow users to supply images for processing or performs additional validation on the images before processing, it may not be vulnerable."

Some Symantec retail products use classes within the Symantec-installed gdiplus.dll for drawing purposes, font display, etc. as well as, in some instances, to display dedicated images extracted from Symantec-installed resource libraries. Symantec products do NOT use the Symantec-installed version of gdiplus.dll to render user-supplied JPEG images.

While not vulnerable to exploitation attempts described in Microsoft's Bulletin MS04-028, Symantec initiated an update program during normal maintenance to upgrade the gdiplus.dll version installed with our affected products to the latest gdiplus.dll release available. Once fully certified and thoroughly tested the applicable updates were posted for download via Symantec LiveUpdate.

Symantec customers who regularly run Symantec LiveUpdate should already be updated to the current gdiplus.dll in most affected products. However, the Symantec gdiplus.dll update requires a current version of Symantec Windows LiveUpdate to download and install properly on some of the affected products. The current version of Symantec Windows LiveUpdate is version 2.6 that is available for download from the Symantec technical support site at http://www.symantec.com/techsupp/files/lu/lu.html.

To determine your version of Symantec LiveUpdate:
  • Open any Symantec product installed on your system that uses LiveUpdate, e.g., Symantec SystemWorks 2005
  • Click on LiveUpdate in the toolbar
  • Click on the LiveUpdate system menu to see the drop-down selections
  • Click on "About LiveUpdate" to determine the version of LiveUpdate running
If you are running a version of Symantec LiveUpdate prior to v2.6, you should download Symantec Windows LiveUpdate v2.6 from the support site indicated above to upgrade your system to the latest release of Symantec Windows LiveUpdate.

The Symantec LiveUpdate upgrade may require a restart of your system to properly initialize the updated version. Continue to run Symantec LiveUpdate until LiveUpdate indicates that all installed products are up-to-date.

As a part of normal user best practice, Symantec highly recommends a multi-layered approach to security to ensure a strong security profile.
  • Users, at a minimum, should run both a personal firewall and antivirus application with current updates to provide multiple points of detection and protection to both inbound and outbound threats.
  • Users should keep vendor-supplied patches for all application software and operating systems up-to-date.
  • Users should be cautious of mysterious attachments and executables delivered via email and be cautious of visiting unknown/untrusted websites or following unknown URL links.
  • Do not open unidentified attachments or executables from unknown sources or that you did not request.
  • Always err on the side of caution. Even if the sender is known, the source address may be faked.
  • If in doubt, contact the sender to confirm they sent the attachment and why before opening the attachment. If still in doubt, delete the attachment.

Symantec takes the security and proper functionality of our products very seriously. As founding members of the Organization for Internet Safety (OISafety), Symantec supports and follows the principles of responsible disclosure. Symantec also subscribes to the vulnerability disclosure guidelines outlined by the National Infrastructure Advisory Council (NIAC).

Please contact secure@symantec.com if you feel you have discovered a security issue in a Symantec product. A Symantec Product Security team member will contact you regarding your submission. Symantec strongly recommends using encrypted email for reporting vulnerability information to secure@symantec.com. The Symantec Product Security PGP key can be found at the end of this message.

Symantec has developed a Product Vulnerability Response document outlining the process we follow in addressing suspected vulnerabilities in our products. This document is available below.

PDF Symantec Vulnerability Response Policy PGP Symantec Product Vulnerability Management PGP Key

Copyright © by Symantec Corp.
Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from secure@symantec.com.

The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and secure@symantec.com are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.

Last modified on: Wednesday, 19-Jan-05 09:00:50