Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-Disclosure] Bypass of 22 Antivirus software with GDI+ bug expl

from [Trog] Network Security [Permanent Link]
Subject: Re: [Full-Disclosure] Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2
Date: Mon, 07 Mar 2005 16:51:12 +0000 
On Fri, 2005-03-04 at 15:03 -0600, Andrey Bayora wrote:


The issue is: only 1 out of 23 tested antivirus software can detect
malicious JPEG image (after 6 month from the public disclosure date).


Perhaps this fact should have rung some alarm bells in your mind.



Here is the link to results, JPEG file and my paper (GCIH practical)
that describes how to create this one:
http://www.hiddenbit.org/jpeg.htm


I had a look at your supposed JPEG exploit file, bulzano2.jpg,
downloaded from the URL you supplied above, and read the 84 page PDF
you've generated to explain your processes.

You appear to have made an error.

The segments of a JPEG file are chained together. In bulzano2.jpg, the
chain goes as follows:

Offset Marker Size Comment
--------------------------

0x0000 FFDB        Start of image marker
0x0002 FFE0   0010 JFIF APP0 marker: next in chain = 0x0004
+0x0010=0x0014
0x0014 FFED   191c APP marker: next in chain = 0x0016+0x191c=0x1932

According to your paper you've added your exploit at offset 0x0210,
which is in the middle of the APP segment that ranges from 0x0018 to
0x1932, as such this is not a valid exploit. The data at 0x0210 may look
like a segment marker, but isn't.

Please explain if I have missed something.

-trog

Attachment: signature.asc
Description: This is a digitally signed message part

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] Administrivia: A new home for FD, John Cartwright
Next by Date:  [USN-91-1] EXIF library vulnerability, Martin Pitt
Previous by Thread:  [Full-Disclosure] Re: Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2, "Vincent DUVERNET (Nolmë Informatique)"
Next by Thread:  Re: [Full-Disclosure] Bypass of 22 Antivirus software with GDI+ bug exploit Mutations - part 2, Andrey Bayora
Indexes:  [Date] [Thread] [Top] [All Lists]