Comments on: Quickpost: /JBIG2Decode Trigger Trio http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/ (blog 'DidierStevens) Thu, 29 Jul 2010 03:37:46 +0000 hourly 1 http://wordpress.com/ By: PDF a rischio exploit anche senza doppio click - CaptersTux http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-37716 PDF a rischio exploit anche senza doppio click - CaptersTux Thu, 18 Feb 2010 17:19:07 +0000 http://blog.didierstevens.com/?p=1275#comment-37716 [...] illustrato da Stevens all”interno del suo post, Adobe Reader si integra in Windows Explorer permettendo [...] [...] illustrato da Stevens all”interno del suo post, Adobe Reader si integra in Windows Explorer permettendo [...]

]]> By: Leeroy http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-36552 Leeroy Wed, 25 Nov 2009 00:14:02 +0000 http://blog.didierstevens.com/?p=1275#comment-36552 #14: Yeah you're right look what's in pdfshell.dll HKCR { NoRemove CLSID { ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s 'PDF Shell Extension' { InprocServer32 = s '%MODULE%' { val ThreadingModel = s 'Apartment' } } } NoRemove Folder { NoRemove Shellex { NoRemove ColumnHandlers { ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s 'PDF Column Info' } } } NoRemove AcroExch.Document.7 { NoRemove Shellex { ForceRemove {BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} = s '{F9DB5320-233E-11D1-9F84-707F02C10627}' NoRemove PropertySheetHandlers { ForceRemove InfoPage = s '{F9DB5320-233E-11D1-9F84-707F02C10627}' } } } } #14: Yeah you’re right look what’s in pdfshell.dll

HKCR
{
NoRemove CLSID
{
ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s ‘PDF Shell Extension’
{
InprocServer32 = s ‘%MODULE%’
{
val ThreadingModel = s ‘Apartment’
}
}
}

NoRemove Folder
{
NoRemove Shellex
{
NoRemove ColumnHandlers
{
ForceRemove {F9DB5320-233E-11D1-9F84-707F02C10627} = s ‘PDF Column Info’
}
}
}

NoRemove AcroExch.Document.7
{
NoRemove Shellex
{
ForceRemove {BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} = s ‘{F9DB5320-233E-11D1-9F84-707F02C10627}’

NoRemove PropertySheetHandlers
{
ForceRemove InfoPage = s ‘{F9DB5320-233E-11D1-9F84-707F02C10627}’
}
}
}
}

]]> By: Martin Holst Swende » Blog Archive » Metadata-exploits (Windows) http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-36470 Martin Holst Swende » Blog Archive » Metadata-exploits (Windows) Sat, 21 Nov 2009 21:26:33 +0000 http://blog.didierstevens.com/?p=1275#comment-36470 [...] inget om den är skadlig – den kan inte göra något. Didier Stevens har postat en video ( http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/ )på tre scenarior där malware lyckas exekvera utan att filen “öppnas” genom att [...] [...] inget om den är skadlig – den kan inte göra något. Didier Stevens har postat en video ( http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/ )på tre scenarior där malware lyckas exekvera utan att filen “öppnas” genom att [...]

]]> By: Blog » Blog Archive » Und immer wieder PDF-Angriffe http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-35181 Blog » Blog Archive » Und immer wieder PDF-Angriffe Thu, 18 Jun 2009 06:40:27 +0000 http://blog.didierstevens.com/?p=1275#comment-35181 [...] gezeigt, dass er irrt. Zu vier Angriffsvarianten die der Security-Analyst Didier Stevens vorgestellt hat berichtete ich [...] [...] gezeigt, dass er irrt. Zu vier Angriffsvarianten die der Security-Analyst Didier Stevens vorgestellt hat berichtete ich [...]

]]> By: ψ² = Ps(i)² » Blog Archive » Wer hat an der Uhr gedreht… http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-35109 ψ² = Ps(i)² » Blog Archive » Wer hat an der Uhr gedreht… Wed, 10 Jun 2009 09:20:35 +0000 http://blog.didierstevens.com/?p=1275#comment-35109 [...] Dazu nutzt er die /JBIG2 Schwachstelle. Schon im März hatte der Security-Resercher drei Methoden vorgestellt, bei denen zwar keine Datei geöffnet werden, aber das Opfer immerhin noch passiv mitwirken musste. [...] [...] Dazu nutzt er die /JBIG2 Schwachstelle. Schon im März hatte der Security-Resercher drei Methoden vorgestellt, bei denen zwar keine Datei geöffnet werden, aber das Opfer immerhin noch passiv mitwirken musste. [...]

]]> By: /dev/random » Blog Archive » Use Google Mail as a Sandbox http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34694 /dev/random » Blog Archive » Use Google Mail as a Sandbox Fri, 24 Apr 2009 20:02:28 +0000 http://blog.didierstevens.com/?p=1275#comment-34694 [...] a few months, PDF files have been hit by several security issues and recently, a zero-day exploit targeted Powerpoint files. Why not use GMail as a sandbox? [If you [...] [...] a few months, PDF files have been hit by several security issues and recently, a zero-day exploit targeted Powerpoint files. Why not use GMail as a sandbox? [If you [...]

]]> By: OIT Software Support Blog · PDF Threat! http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34351 OIT Software Support Blog · PDF Threat! Thu, 12 Mar 2009 16:59:50 +0000 http://blog.didierstevens.com/?p=1275#comment-34351 [...] about the vulnerability and proof-of-concept videos can be found here for the inquiring minds.PDF Exploit Search this [...] [...] about the vulnerability and proof-of-concept videos can be found here for the inquiring minds.PDF Exploit Search this [...]

]]> By: Adobe rilascia finalmente la patch per Adobe Reader e Acrobat 9.1 » Italia SW http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34341 Adobe rilascia finalmente la patch per Adobe Reader e Acrobat 9.1 » Italia SW Wed, 11 Mar 2009 13:00:15 +0000 http://blog.didierstevens.com/?p=1275#comment-34341 [...] bug che “consentiva agli autori di malware di portare a termine infezioni nel nostro sistema senza “obbligarci” all’apertura di un file PDF opportunamente modificato” (leggi l’articolo Il BUG [...] [...] bug che “consentiva agli autori di malware di portare a termine infezioni nel nostro sistema senza “obbligarci” all’apertura di un file PDF opportunamente modificato” (leggi l’articolo Il BUG [...]

]]> By: A New Twist to the Adobe Vulnerability - Yudhitech DotNet http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34339 A New Twist to the Adobe Vulnerability - Yudhitech DotNet Wed, 11 Mar 2009 08:11:42 +0000 http://blog.didierstevens.com/?p=1275#comment-34339 [...] releases its patch next week, think again. Didier Stevens, an IT security consultant last week demonstrated that simply viewing the folder containing compromised PDF documents within Microsoft’s [...] [...] releases its patch next week, think again. Didier Stevens, an IT security consultant last week demonstrated that simply viewing the folder containing compromised PDF documents within Microsoft’s [...]

]]> By: rath's me2DAY http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/#comment-34338 rath's me2DAY Wed, 11 Mar 2009 07:00:35 +0000 http://blog.didierstevens.com/?p=1275#comment-34338 <strong>rath의 생각...</strong> Acrobat Reader도 해킹툴로 쓰일 수 있다니.. 게다가 PDF 파일을 열지 않아도 된단다. -_- 여튼 오늘 패치가 떴으니 Windows 에서 PDF 보는 사람은 꼭 설치하시길.... rath의 생각…

Acrobat Reader도 해킹툴로 쓰일 수 있다니.. 게다가 PDF 파일을 열지 않아도 된단다. -_- 여튼 오늘 패치가 떴으니 Windows 에서 PDF 보는 사람은 꼭 설치하시길….

]]>