Binary over JPEG

BROWSE BY TAG Application Security,   Application and Platform Security,   Web Security Tools and Best Practices,   Web Application Security,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Application Security How to secure a .pdf file How do hackers bypass a code signing procedure to inject malware Do Facebook URL security concerns justify blocking social networks? What are Google Chrome's security features? Is there a way to block iPhone widgets that bypass Web filters? Should enterprises be concerned with Twitter in the workplace? Are there still Google Desktop security problems? Can an IP spoofing tool be used to spam SPF servers? Will an application usage policy best control network bandwidth? How can URL-shortening services be manipulated? Web Application Security Black box and white box testing: Which is best? InZero Systems launches hardware-based security gateway Web application vulnerability assessment shows patching progress Preventing SQL injection attacks: A network admin's perspective Cisco acquires SaaS security vendor ScanSafe Web application firewall use goes beyond compliance, company finds Gumblar Trojan drive-by exploits spike following Adobe update Some Facebook applications lead to Russian attack sites Barracuda acquires Purewire expanding Web security reach An enterprise strategy for Web application security threats

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary anonymous Web surfing  (SearchSecurity.com) buffer overflow  (SearchSecurity.com) cache cramming  (SearchSecurity.com) cookie poisoning  (SearchSecurity.com) dictionary attack  (SearchSecurity.com) distributed denial-of-service attack  (SearchSecurity.com) JavaScript hijacking  (SearchSecurity.com) National Computer Security Center  (SearchSecurity.com) threat modeling  (SearchSecurity.com) trigraph  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Many Microsoft products, including the Office Suite programs, Internet Explorer, Windows XP and Windows Server 2003, use a dynamic link library (DLL) file called GDIPlus.dll. It contains libraries for the Graphical Device Interface Plus (GDI+) application programming interface (API). This allows programmers to represent graphical objects and transmit them to output devices, such as monitors and printers. This DLL includes the capability to process JPEG image files. Sadly, the way it handles malformed JPEG images can cause a heap-based buffer overflow. Heap-based buffer vulnerabilities occur if the unchecked copy of data is written to a buffer that is located on the heap. This allows non-executable stack protection mechanisms to be bypassed, leaving the system vulnerable.

In this instance, the overflow arises because the DLL normalizes the declared length of the area designed for comments in a JPEG file prior to checking its value. This area can store up to 65,533 bytes of data, but takes up only two bytes if no comment is added to the image. If the malicious hacker sets the comment length value to 1 or 0, it will result in a heap-based overflow, overwriting the heap management structures. This allows the hacker to point the next process to code they wish to run, which ironically they can store in the comment area of the JPEG file!

In order to exploit the flaw, an attacker only needs the victim to view the doctored JPEG image. This file is typically sent in an HTML e-mail or displayed on a Web site. The JPEG image can also be embedded in a Word, PowerPoint or other Microsoft Office document. Once viewed, the embedded Trojan horse code will run on the infected system with the privileges of the application that opened the JPEG file. This vulnerability was announced in September 2004 and due to its severity, Microsoft released a patch very quickly to correct the problem. It is covered in Microsoft Security Bulletin MS04-028 "Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)".

You can download the file containing the source code for a proof-of-concept at http://www.macconvert.com/archives/docs/JPEGdownloader.doc.sitx. This should help you understand how the attack works.