Even more GDI confusion

Hi all --

I've been collecting and reconciling the vast amounts of information
available about MS04-028, and alas I'm not getting LESS confused.

Tom Liston's doc for GDI Scan says that it's okay to ignore the
%windowsroot%\WinSxS instances of gdiplus.dll because they're used for
backup and uninstall purposes, but I don't think that's true -- they're used
every time a stand-alone app needs a potentially-shared library, if I'm
understanding MSDN correctly:

<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sbscs/setu
p/assembly_searching_sequence.asp>

But it gets worse than that -- I've checked six different installs of WinXP
in various stages of use and patching, and I can't find a single one that
>has< gdiplus.dll in the system32 directory!  So for all you folks who are
patching your OS, where is that file going?

I'll keep
http://orb.infoexpress.com/forums/index.php?topic=607.msg863#msg863> updated
as I get more information.

thanks for any assistance -- tbird


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions