Re: Windows .ANI LoadAniIcon Stack Overflow

["Michal Majchrowicz" <m.majchrowicz () gmail com>]

Hi.
There are more and more reports about FF and ani vulnerability.
There was already a presentation of working exploit.
The thing starts to annoy me and since I am far away from any windows
I wanted to share some of my speculations.
According to docs two things are obvious:
1) Firefox doesn't support ANI cursors
2) ANI is just few cur cursors packed together and presented as an animation.
So i have three possible ways of exploiting it:
1) Since ANI files are vulnerable then maybe cur files are also
vulnerable. Firefox does support CUR files.
2) If firefox doesn't support ANI files it only means it doesn't
render them. It doesn't mean it will not acept them in any way:)
3) Maybe it is possible to rename foo.ani and rename it to foo.cur.
Then FF will call win api with this cursor. Windows API will recognize
this as ANI file and call vulnerable function .
As I said before these are just speculation. I hope someone will be
able to confirm or prove that some of them (or all) have no sense.
Happy Easter to everyone.
Regards Michal.

On 4/4/07, Peter Ferrie <pferrie () symantec com> wrote:
> > That's correct, Firefox doesn't support ANI files for cursors.
>
> Right, and it doesn't need to, because cursors are not the only way to reach the vulnerable code.
> Icons can do it, too.
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/