Vulnerability Development mailing list archives

Re: Infected jpeg files?


From: H C <keydet89 () yahoo com>
Date: Fri, 9 Nov 2001 12:18:06 -0800 (PST)

Terry,

... if i recall correctly, i've read of <javascript>
commands embedded as
comments in graphics files that allowing them.  feed
that to an M$ driven
viewer ...

Got any references for any of these comments?  I
remember the "Chasing the Wind" series having some
mention of embedding JavaScript in the comments fields
of GIF files, but (a) that's a fictional series, and
(b) I never saw a follow-on installment that addressed
the situation.

You seem to have some inside knowledge, though.  Are
you saying that a MS driven viewer will not only read
in a stream of bytes that constitute a graphics file,
but it will also execute arbitrary commands embedded
in the file?  If so, which viewers are you referring
to specifically, or is this a general statement?

__________________________________________________
Do You Yahoo!?
Find a job, post your resume.
http://careers.yahoo.com


Current thread: