Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: FW: [Full-Disclosure] JPEG AV Detection
From: Gerry Eisenhaur (GEisenhaurcisco.com)
Date: Tue Sep 28 2004 - 15:44:01 CDT
After looking in to what the AV companies base their signature on, it
appears that they use the \xff\xfe\x00\x00 or \xff\xfe\x00\x01 string in
the vulnerable JPEG. If you change the size to a valid size, the AV is
I know there is some talk about other sections being vulnerable to
overflow as well, I have not look into this yet so I can not be sure. If
it is true, I wonder if the AV companies are aware/detect the possible
Anyone else have any input?
Todd Towles wrote:
> What exactly are the AV products detecting in the JPEG exploits? Barry
> and I was talking about how impressed we were that the AV companies
> jumped on this one and detection was pretty fast. But is the detection
> so generic that a variant will bypass? Is the detection based on a
> original exploit that could be modified in a way that makes it
> "undetectable" right now?
> -----Original Message-----
> From: Barry Fitzgerald [mailto:bkfsecsdf.lonestar.org]
> Sent: Tuesday, September 28, 2004 1:55 PM
> To: Todd Towles
> Subject: Re: [Full-Disclosure] Re: Full-Disclosure digest, Vol 1 #1933 -
> 20 msgs
> Todd Towles wrote:
>>Yep, really surprised. Just hopefully the invalid data that is being
>>detected can't be changed or worked in a work that would bypass normal
>>detection. Once the file is renamed to a BMP or a GIF, you confuse the
>>whole thing even more.
>>Are the AV products hitting on a part of the original exploit? Can this
>>part be changed in a future version to make it "undetectable". I am
>>very impressed at the work of the AV companines on this one, but I also
>>know that is this detection is too simple, that it will be bypassed.
> I'm not sure what they're specifically detecting. This may be a good
> question for the list.
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
Cisco Systems, Inc.
1414 Massachusetts Ave.
Boxborough, Massachusetts 01719
Full-Disclosure - We believe in it.