full-disclosure - IE exploit runs code from graphics?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200406250212.i5P2Ccu14296@netsys.com>
From: larry at larryseltzer.com (Larry Seltzer)
Subject: IE exploit runs code from graphics?

>>Without having access to any of the information as to what web pages NetSec thinks is
involved, 
>>but having seen many recent posts about the so-called "RFI - Russian IIS Hacks" I'd
suggest 
>>that both reports are referring to one and the same, or at least, very closely
related, things.
>>...
>>That is hardly the same thing as "embedded code hidden in graphics on Web pages"...

Yup, once I saw the SANS writeups I came to the same conclusion. So there's nothing
really new in the client-side exploit and what's happening on the server hasn't been
figured out yet, right? And it sounds like if you're up to date on patches and antivirus
you're probably protected against the client-side exploit. 

Larry Seltzer