> This experiment resulted in identifying a potential remote code > execution path in Microsoft Internet Explorer, plus some other bugs, and > should be a good starting point for further testing of other browsers or > similar programs. Just for the reference, this is confirmed to be fixed by the most recent (and long overdue) cummulative update for MSIE (a part of MS05-038): JPEG Image Rendering Memory Corruption Vulnerability - CAN-2005-1988 A remote code execution vulnerability exists in Internet Explorer because of the way that it handles JPEG images. An attacker could exploit the vulnerability by constructing a malicious JPEG image that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system. Thought I'd clarify, because CVE seems to carry original references with one candidate entry (CAN-2005-2308), and Microsoft's patch with no prior references in another (CAN-2005-1988) - so there might be some confusion as to what was fixed and why. CERT and Securityfocus both include proper data, though. Cheers, /mz http://lcamtuf.coredump.cx/silence/
#!/bin/bash echo "Content-Type: text/html" echo ID="timg-$$-$RANDOM-$RANDOM" rm -f timg-* AFX.log cat <<_EOF_ <HTML> <HEAD> <META HTTP-EQUIV="Refresh" content="0;URL=/"> </HEAD> <BODY> _EOF_ CNT=0 for i in img/*; do CNT="$[CNT+1]" FNAM="$ID-$CNT" EXT=`echo $i | cut -d. -f2` ./afx-loc -p 1 -i 100 -m RANDOM -s 60000 <$i 2>$FNAM.$EXT >>AFX.log echo "Test $CNT - <IMG SRC=\"$FNAM.$EXT\"><BR>" done
