[Full-Disclosure] [Vmyths.com ALERT] Hysteria predicted for 'JPEG Processor' vulnerability
nick at virus-l.demon.co.uk
Thu Sep 16 05:04:05 BST 2004
Barry Fitzgerald wrote:
> Why did this need a Vmyths advisory?
> So far, I haven't read any disinformation in the media regarding this.
> A virus can actually be embedded in the file with this vulnerability
> (or, any program, really) and the vulnerable programs really can be
> exploited using the jpeg files. I don't think this is at all comparible
> to an april fools joke or a steganography-using malware implementation
> -- they're completely different than this.
> If you want a prediction, my experience would indicate that this is more
> likely to be utilized than it is to not be utilized. Perhaps not in
> mass-use by attackers, but I would predict that we're probably going to
> see one or two, at least, adware/spyware distributors using this. It's
> the kind of hole that they love. So, yeah, patch away - as usual.
I tend to agree with Barry (no relation) here.
The buffer overflow in IE's handling of .BMP files, "found within five
minutes of the Win2K source code leak", _was_ actively exploited by
spammers to push out a small program that downloaded and installed
other malware/spyware. It was never much of a story as it was used at
a rather low rate (at least if your Email address was not in a domain
where Russian versions of Windows were likely to be found) and it
(probably) only worked on Russian Win2K SP1 (from memory; and then
maybe only if you hadn't upgraded to IE 6.0?) due to the address used
for the "jump back to overflow payload" instruction. Anyway, the point
is, some enterprising hacker/spammer obviously felt that vulnerability
could provide enough of an edge for some perceived market such that it
was worth their time to explore further and develop a working exploit.
> I think that what people should take away from this is that files are
> input and programs shouldn't just explicitely trust input ...
Well, sometimes they _must_. If so, such programs must be written
especially carefully with much thought paid to designing safe exception
detection. This is clearly a case where that has not happened (and is
very similar to recent issues in imlib and other *nix-ish graphics
libraries, zlib and so on as reported over the last few weeks).
> ... -- but they
> often do, or their trust controls are circumvented, and bad nasty files
> can do damage. So the moral of the story is: be careful who you get
> your software from, because you have to load files which means that the
> vendor that trusts the input the least is the one that you want.
> I will say that Microsoft's release was confusing (not inappropriately
> so -- the matrix of affected software isn't as simple as it normally is)
> and that will generate some very poor advice, but where's the fire? I
> haven't seen any hoaxes at the moment and none were cited... so, where's
> the fire?
The real question is...
If there are no "hoaxes" or undue media hype about this, will Rob claim
that his "warning" saved us from the devastation of the hypesters??
(Sorry Rob, couldn't resist...)
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854
Full-Disclosure is hosted and sponsored by Secunia.