In this instance, the overflow arises because the DLL normalizes the declared length of the area designed for comments...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
in a JPEG file prior to checking its value. This area can store up to 65,533 bytes of data, but takes up only two bytes if no comment is added to the image. If the malicious hacker sets the comment length value to 1 or 0, it will result in a heap-based overflow, overwriting the heap management structures. This allows the hacker to point the next process to code they wish to run, which ironically they can store in the comment area of the JPEG file!
In order to exploit the flaw, an attacker only needs the victim to view the doctored JPEG image. This file is typically sent in an HTML e-mail or displayed on a Web site. The JPEG image can also be embedded in a Word, PowerPoint or other Microsoft Office document. Once viewed, the embedded Trojan horse code will run on the infected system with the privileges of the application that opened the JPEG file. This vulnerability was announced in September 2004 and due to its severity, Microsoft released a patch very quickly to correct the problem. It is covered in Microsoft Security Bulletin MS04-028 "Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)".
You can download the file containing the source code for a proof-of-concept at http://www.macconvert.com/archives/docs/JPEGdownloader.doc.sitx. This should help you understand how the attack works.
Dig Deeper on Web Application Security
Related Q&A from Michael Cobb
The TLS protocol has fallen on hard times, but expert Michael Cobb explains how client puzzles can help fix some of the problems.continue reading
Microsoft's Wi-Fi Sense for Windows 10 can share encrypted passwords for Wi-Fi networks, but is it safe? Expert Michael Cobb has the answer.continue reading
Several security vendors and providers have been hacked over the last year. Expert Michael Cobb explains how enterprises should prepare for a vendor ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.