bugtraq - Airpwn & libpng holes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 6 Aug 2004 18:17:00 -0700
From: Matt Venzke <mvenzke@...il.com>
To: bugtraq@...urityfocus.com
Subject: Airpwn & libpng holes

Has anyone seen any exploit images based on the libpng hole capable of
more than just crashing the system yet?

I was trying to figure if airpwn
(https://sourceforge.net/projects/airpwn/) could be used to do much
more than simply annoy people, and it occured to me that if anyone has
managed to craft truely malicious PNGs, they could easily use airpwn
to distribute them en masse, with the user-agent helping them figure
out which image to send, even if that wouldn't always be reliable...

Not that this is unique--I suppose you could also distribute malicious
bitmaps to anyone still using older versions of IE, or to distribute
any other sort of similarly malicious content.

All the more reason to convince people to secure their wireless
networks and update their software, I guess.

- Matt