MSN Messenger PNG Image Parsing Vulnerability
Core Security Technologies has made available asample malformed PNG file that can be used to check if an MSN Messengerclient is vulnerable.
The ZIP-compressed image is available at http://www.coresecurity.com/corelabs/advisories/msn-vulncheck.zip
Afterdownloading it, uncompress and save it to a work folder, open MSNMessenger and select the image as your display picturein "Tools->Change Display Picture".
Vulnerable clients will either crash or display popup dialog with the following text: "Your MSN Messenger client is vulnerable"
L'advisorie complet avec les details de l'exploitation:
http://www.coresecurity.com/common/showdoc...1&idxseccion=10
Comme preciser dans l'advisories, mettre l'affichage des images en disable ne suffit pas a bloquer l'attaque. Seul la mise en place du patch: http://www.microsoft.com/technet/security/bulletin/MS05-009.mspx
permet d'arreter l'exploitation.
The ZIP-compressed image is available at http://www.coresecurity.com/corelabs/advisories/msn-vulncheck.zip
Afterdownloading it, uncompress and save it to a work folder, open MSNMessenger and select the image as your display picturein "Tools->Change Display Picture".
Vulnerable clients will either crash or display popup dialog with the following text: "Your MSN Messenger client is vulnerable"
L'advisorie complet avec les details de l'exploitation:
http://www.coresecurity.com/common/showdoc...1&idxseccion=10
Comme preciser dans l'advisories, mettre l'affichage des images en disable ne suffit pas a bloquer l'attaque. Seul la mise en place du patch: http://www.microsoft.com/technet/security/bulletin/MS05-009.mspx
permet d'arreter l'exploitation.
Publicité