RE: IE exploit runs code from graphics?

["Larry Seltzer" <larry () larryseltzer com>]

> > Without having access to any of the information as to what web pages NetSec thinks is
involved, 
> > but having seen many recent posts about the so-called "RFI - Russian IIS Hacks" I'd
suggest 
> > that both reports are referring to one and the same, or at least, very closely
related, things.
> > ...
> > That is hardly the same thing as "embedded code hidden in graphics on Web pages"...

Yup, once I saw the SANS writeups I came to the same conclusion. So there's nothing
really new in the client-side exploit and what's happening on the server hasn't been
figured out yet, right? And it sounds like if you're up to date on patches and antivirus
you're probably protected against the client-side exploit. 

Larry Seltzer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html