<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
		>
<channel>
	<title>Comments on: Quickpost: /JBIG2Decode Trigger Trio</title>
	<atom:link href="http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/</link>
	<description>(blog 'DidierStevens)</description>
	<lastBuildDate>Sat, 11 Feb 2012 16:16:49 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.com/</generator>
	<item>
		<title>By: Quick post &#124; Wishka</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-43201</link>
		<dc:creator><![CDATA[Quick post &#124; Wishka]]></dc:creator>
		<pubDate>Sun, 29 May 2011 04:16:19 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-43201</guid>
		<description><![CDATA[[...] Quickpost: /JBIG2Decode Trigger Trio « Didier StevensDS, Quick question, how many AVs on virus total detected these 3 pdfs properly … [...] Slashdot, I just ran across Didier Stevens post on how to automate the JBIG2decode vulnerability in PDF documents.  There is a video on the site where he runs through three [...] [...]]]></description>
		<content:encoded><![CDATA[<p>[...] Quickpost: /JBIG2Decode Trigger Trio « Didier StevensDS, Quick question, how many AVs on virus total detected these 3 pdfs properly … [...] Slashdot, I just ran across Didier Stevens post on how to automate the JBIG2decode vulnerability in PDF documents.  There is a video on the site where he runs through three [...] [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Quickpost: "It Does No Harm&#8230;" or Does It? &#171; Didier Stevens</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-41483</link>
		<dc:creator><![CDATA[Quickpost: "It Does No Harm&#8230;" or Does It? &#171; Didier Stevens]]></dc:creator>
		<pubDate>Mon, 17 Jan 2011 00:00:59 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-41483</guid>
		<description><![CDATA[[...] to name here because of SEO reasons), installs a Windows explorer shell extension (we&#8217;ve discussed the risks of these shells before). The problem with this tool&#8217;s shell extension (a DLL), is that it is compiled without the [...]]]></description>
		<content:encoded><![CDATA[<p>[...] to name here because of SEO reasons), installs a Windows explorer shell extension (we&#8217;ve discussed the risks of these shells before). The problem with this tool&#8217;s shell extension (a DLL), is that it is compiled without the [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: PDF a rischio exploit anche senza doppio click - CaptersTux</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-37716</link>
		<dc:creator><![CDATA[PDF a rischio exploit anche senza doppio click - CaptersTux]]></dc:creator>
		<pubDate>Thu, 18 Feb 2010 17:19:07 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-37716</guid>
		<description><![CDATA[[...] illustrato da Stevens all&#8221;interno del suo post, Adobe Reader si integra in Windows Explorer permettendo [...]]]></description>
		<content:encoded><![CDATA[<p>[...] illustrato da Stevens all&#8221;interno del suo post, Adobe Reader si integra in Windows Explorer permettendo [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Leeroy</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-36552</link>
		<dc:creator><![CDATA[Leeroy]]></dc:creator>
		<pubDate>Wed, 25 Nov 2009 00:14:02 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-36552</guid>
		<description><![CDATA[#14: Yeah you&#039;re right look what&#039;s in pdfshell.dll

HKCR
{
	NoRemove CLSID
	{
		ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s &#039;PDF Shell Extension&#039;
		{
			InprocServer32 = s &#039;%MODULE%&#039;
			{
				val ThreadingModel = s &#039;Apartment&#039;
			}
		}
	}

    NoRemove Folder
    {
        NoRemove Shellex
        {
            NoRemove ColumnHandlers
            {
                ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s &#039;PDF Column Info&#039;
            }
        }
    }

	NoRemove AcroExch.Document.7
	{
		NoRemove Shellex
		{
            ForceRemove {BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} = s &#039;{F9DB5320-233E-11D1-9F84-707F02C10627}&#039;

			NoRemove PropertySheetHandlers
			{
				ForceRemove InfoPage = s &#039;{F9DB5320-233E-11D1-9F84-707F02C10627}&#039;
			}
		}
	}
}]]></description>
		<content:encoded><![CDATA[<p>#14: Yeah you&#8217;re right look what&#8217;s in pdfshell.dll</p>
<p>HKCR<br />
{<br />
	NoRemove CLSID<br />
	{<br />
		ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s &#8216;PDF Shell Extension&#8217;<br />
		{<br />
			InprocServer32 = s &#8216;%MODULE%&#8217;<br />
			{<br />
				val ThreadingModel = s &#8216;Apartment&#8217;<br />
			}<br />
		}<br />
	}</p>
<p>    NoRemove Folder<br />
    {<br />
        NoRemove Shellex<br />
        {<br />
            NoRemove ColumnHandlers<br />
            {<br />
                ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s &#8216;PDF Column Info&#8217;<br />
            }<br />
        }<br />
    }</p>
<p>	NoRemove AcroExch.Document.7<br />
	{<br />
		NoRemove Shellex<br />
		{<br />
            ForceRemove {BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} = s &#8216;{F9DB5320-233E-11D1-9F84-707F02C10627}&#8217;</p>
<p>			NoRemove PropertySheetHandlers<br />
			{<br />
				ForceRemove InfoPage = s &#8216;{F9DB5320-233E-11D1-9F84-707F02C10627}&#8217;<br />
			}<br />
		}<br />
	}<br />
}</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Martin Holst Swende &#187; Blog Archive &#187; Metadata-exploits (Windows)</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-36470</link>
		<dc:creator><![CDATA[Martin Holst Swende &#187; Blog Archive &#187; Metadata-exploits (Windows)]]></dc:creator>
		<pubDate>Sat, 21 Nov 2009 21:26:33 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-36470</guid>
		<description><![CDATA[[...] inget om den är skadlig &#8211; den kan inte göra något. Didier Stevens har postat en video ( http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/ )på tre scenarior där malware lyckas exekvera utan att filen &#8220;öppnas&#8221; genom att [...]]]></description>
		<content:encoded><![CDATA[<p>[...] inget om den är skadlig &#8211; den kan inte göra något. Didier Stevens har postat en video ( <a href="http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/" rel="nofollow">http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/</a> )på tre scenarior där malware lyckas exekvera utan att filen &#8220;öppnas&#8221; genom att [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Blog &#187; Blog Archive &#187; Und immer wieder PDF-Angriffe</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-35181</link>
		<dc:creator><![CDATA[Blog &#187; Blog Archive &#187; Und immer wieder PDF-Angriffe]]></dc:creator>
		<pubDate>Thu, 18 Jun 2009 06:40:27 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-35181</guid>
		<description><![CDATA[[...] gezeigt, dass er irrt. Zu vier Angriffsvarianten die der Security-Analyst Didier Stevens vorgestellt hat berichtete ich [...]]]></description>
		<content:encoded><![CDATA[<p>[...] gezeigt, dass er irrt. Zu vier Angriffsvarianten die der Security-Analyst Didier Stevens vorgestellt hat berichtete ich [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: ψ² = Ps(i)² &#187; Blog Archive &#187; Wer hat an der Uhr gedreht&#8230;</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-35109</link>
		<dc:creator><![CDATA[ψ² = Ps(i)² &#187; Blog Archive &#187; Wer hat an der Uhr gedreht&#8230;]]></dc:creator>
		<pubDate>Wed, 10 Jun 2009 09:20:35 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-35109</guid>
		<description><![CDATA[[...] Dazu nutzt er die /JBIG2 Schwachstelle. Schon im März hatte der Security-Resercher drei Methoden vorgestellt, bei denen zwar keine Datei geöffnet werden, aber das Opfer immerhin noch passiv mitwirken musste. [...]]]></description>
		<content:encoded><![CDATA[<p>[...] Dazu nutzt er die /JBIG2 Schwachstelle. Schon im März hatte der Security-Resercher drei Methoden vorgestellt, bei denen zwar keine Datei geöffnet werden, aber das Opfer immerhin noch passiv mitwirken musste. [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: /dev/random &#187; Blog Archive &#187; Use Google Mail as a Sandbox</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34694</link>
		<dc:creator><![CDATA[/dev/random &#187; Blog Archive &#187; Use Google Mail as a Sandbox]]></dc:creator>
		<pubDate>Fri, 24 Apr 2009 20:02:28 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-34694</guid>
		<description><![CDATA[[...] a few months, PDF files have been hit by several security issues and recently, a zero-day exploit targeted Powerpoint files. Why not use GMail as a sandbox? [If you [...]]]></description>
		<content:encoded><![CDATA[<p>[...] a few months, PDF files have been hit by several security issues and recently, a zero-day exploit targeted Powerpoint files. Why not use GMail as a sandbox? [If you [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: OIT Software Support Blog &#183; PDF Threat!</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34351</link>
		<dc:creator><![CDATA[OIT Software Support Blog &#183; PDF Threat!]]></dc:creator>
		<pubDate>Thu, 12 Mar 2009 16:59:50 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-34351</guid>
		<description><![CDATA[[...] about the vulnerability and proof-of-concept videos can be found here for the inquiring minds.PDF Exploit         Search this [...]]]></description>
		<content:encoded><![CDATA[<p>[...] about the vulnerability and proof-of-concept videos can be found here for the inquiring minds.PDF Exploit         Search this [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Adobe rilascia finalmente la patch per Adobe Reader e Acrobat 9.1 &#187; Italia SW</title>
		<link>http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34341</link>
		<dc:creator><![CDATA[Adobe rilascia finalmente la patch per Adobe Reader e Acrobat 9.1 &#187; Italia SW]]></dc:creator>
		<pubDate>Wed, 11 Mar 2009 13:00:15 +0000</pubDate>
		<guid isPermaLink="false">http://blog.didierstevens.com/?p=1275#comment-34341</guid>
		<description><![CDATA[[...] bug che &#8220;consentiva agli autori di malware di portare a termine infezioni nel nostro sistema senza “obbligarci” all’apertura di un file PDF opportunamente modificato&#8221; (leggi l&#8217;articolo Il BUG [...]]]></description>
		<content:encoded><![CDATA[<p>[...] bug che &#8220;consentiva agli autori di malware di portare a termine infezioni nel nostro sistema senza “obbligarci” all’apertura di un file PDF opportunamente modificato&#8221; (leggi l&#8217;articolo Il BUG [...]</p>
]]></content:encoded>
	</item>
</channel>
</rss>

