ms04-028

[norhymenoreason]

Anyone have any good information on this?  I've seem several discussions but no on has been able to produce solid information.  I know MS has labled it critical, but is it truely critical?  I can understand overflows in processes but how could one hide code inside of a image?  

I'm new to this board and site, please be gentle...

[Metgod]

Hey,

I don't know about this. I have actually heard of this years back but whether it's possible yet is beyond me. Just a guess though. I imagine it could depend on the reader (viewer) of the image. So maybe some programs could be effected. I do know I'll probably read this advisory because it sounds interesting.

As for MS and it being critical...

If it's true, then it could be critical because just about anyone could be effected. But then so could anyone using windows for most things.

MS has never been very honest or even knowledgeable about security though. I think that's pretty obvious. And they wouldn't know critical most of the time if it bit them in the ass. They have in the past flatly denied claims of compromisations against their OS. Example is the Back Orifice backdoor .. if I remember right, it was the year 1998 when The cDc released the first version. The year is irrelevant but MS basically said it wasn't an issue.. even when it was shown to them! Here you have a corporation that develops an OS, and then when it's compromised... REMOTELY.. they say it's not an issue. How can you put trust in such a company ?

Then they have these patches.. and their computer security intiative.. and yet.. they don't release patches until the month. If it's critical that's plenty of time to cause major damage. Hell, I've been hit by a worm (my own fault because of how I set my network up. but I didn't care.. I wanted it that way for some reason despite knowing the risks).. and I got rid of it before there was even a fix. So it wasn't like it was a big deal (except for anger at how badly the code was written). But point is, they take a long time to get fixes in, and then if you add the fact that they wait for the month to pass.. then, you add more time for damage. But if you look at the history of the unixes (and linuxes), fixes are issued almost immediately. It's like treating an infection late in the progress in the human body. It's utterly stupid and less effective.

So you always have to ask yourself what MS is saying or thinking and if it's valid. Actually, you should always ask yourself taht about anyone (including me..), but especially any entity with a bad track record, and Microsoft is infamous for that.

I don't know if that's any use to you, but hopefully it is. If not, well, I tried.

Met

[Metgod]

Ok, I just checked microsoft.com ... seems my idea was right. It is up to the viewer of the image. Considering a lot of it was related to Microsoft, I would not be surprised if this is then indeed true.

Now why any image viewing software would allow this is beyond me... pretty interesting though. Scary too.

Met

[Cobra]

Man i thought this was one of the best vulnerabilities i have seen in a Loooong time.

Yes it is true it is up to the viewer .. But if you are running a windows OS .. then your vulnerable.

[norhymenoreason]

Looks like the POC is out for this vuln, but again I'm not understanding it.  The poc is an actual .jpg but how do I get to the code to help me better understand how this is working?  Any information?  Thanks