Full Disclosure mailing list archives
RE: Bypass of 22 Antivirus software with GDI+bug exploit Mutations - part 2
From: "Randall M" <randallm () fidmail com>
Date: Mon, 7 Mar 2005 18:50:59 -0600
I don't think he did. McAfee newest update now catches it. He did mention embedding in to. RandallM -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Trog Sent: Monday, March 07, 2005 10:54 AM To: Full-Disclosure () lists grok org uk Subject: Re: [Full-disclosure] Bypass of 22 Antivirus software with GDI+bug exploit Mutations - part 2 (re-sending to new FD address) On Fri, 2005-03-04 at 15:03 -0600, Andrey Bayora wrote:
The issue is: only 1 out of 23 tested antivirus software can detect malicious JPEG image (after 6 month from the public disclosure date).
Perhaps this fact should have rung some alarm bells in your mind.
Here is the link to results, JPEG file and my paper (GCIH practical) that describes how to create this one: http://www.hiddenbit.org/jpeg.htm
I had a look at your supposed JPEG exploit file, bulzano2.jpg, downloaded from the URL you supplied above, and read the 84 page PDF you've generated to explain your processes. You appear to have made an error. The segments of a JPEG file are chained together. In bulzano2.jpg, the chain goes as follows: Offset Marker Size Comment -------------------------- 0x0000 FFDB Start of image marker 0x0002 FFE0 0010 JFIF APP0 marker: next in chain = 0x0004 +0x0010=0x0014 0x0014 FFED 191c APP marker: next in chain = 0x0016+0x191c=0x1932 According to your paper you've added your exploit at offset 0x0210, which is in the middle of the APP segment that ranges from 0x0018 to 0x1932, as such this is not a valid exploit. The data at 0x0210 may look like a segment marker, but isn't. Please explain if I have missed something. -trog _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://www.secunia.com/
Current thread:
- Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2 Andrey Bayora (Mar 04)
- Re: Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2 Vincent DUVERNET (Nolmë Informatique) (Mar 05)
- Re: Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2 Trog (Mar 07)
- RE: Bypass of 22 Antivirus software with GDI+bug exploit Mutations - part 2 Randall M (Mar 07)
- <Possible follow-ups>
- Re: Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2 Andrey Bayora (Mar 07)