Jason Coombs PivX Solutions
27/08/04, 00:25
The=20recent=20LIBPNG=20vulnerability=20can=20be=2 0exploited=20by=20sending=
=20HTML=20e-mail=20containing=20an=20embedded=20malicious=20PN G=20image=20r=
eferenced=20locally=20using=20cid:=20as=20well,=20 if=20the=20recipient=20of=
=20the=20e-mail=20is=20using=20a=20vulnerable=20mail=20client .=20See
Chris=20Evans'=20security=20advisory
http://scary.beasts.org/security/CESA-2004-001.txt
Therefore=20this=20issue=20is=20somewhat=20serious ,=20and=20deserves=20more=
=20attention.=20Mail=20clients=20need=20to=20block =20automatic=20display=20=
of=20all=20images,=20not=20just=20those=20referenc ed=20by=20external=20URL=
=20inside=20an=20img=20tag.=20It=20is=20a=20lot=20 of=20work=20to=20locate=
=20vulnerable=20binary=20code,=20notify=20vendors= 20of=20vulnerable=20or=20=
flawed=20products=20and=20teach=20them=20this=20re medial=20basic=20security=
=20principle.=20I=20am=20looking=20for=20volunteer s=20who=20are=20intereste=
d=20in=20helping=20out=20with=20this=20effort.
Does=20anyone=20have=20a=20list=20of=20closed-source=20products=20known=20t=
o=20contain=20LIBPNG=20or=20code=20derived=20from= 20it=20that=20is=20believ=
ed=20vulnerable?
Most=20Secure=20Regards,
Jason=20Coombs
Director=20of=20Forensic=20Services
PivX=20Solutions,=20Inc.
Jcoombs@PivX.com
-----Original=20Message-----
From:=20"CHRIS=20GRABENSTEIN"=20<CGRABENSTEIN@lfcc.edu>
Date:=20Mon,=2023=20Aug=202004=2015:20:39=20
To:<security-basics@securityfocus.com>
Subject:=20RE:=20Images=20being=20pulled=20in=20Ou tlook=202003=20even=20tho=
ugh=20don't=20download=20pictures=20is=20set?
The=20reference=20after=20cid:=20refers=20to=20an= 20image=20embedded=20in=
=20the=20email=20itself.
The=20image=20arrives=20as=20part=20of=20the=20ema il=20rather=20than=20bein=
g=20pulled=20from=20a=20remote
server.
-----Original=20Message-----
From:=20Spencer,=20Mark=20[mailto:mspencer@evidentdata.com]=20
Sent:=20Sunday,=20August=2022,=202004=2012:36=20PM
To:=20security-basics@securityfocus.com
Subject:=20Images=20being=20pulled=20in=20Outlook= 202003=20even=20though=20=
don't=20download
pictures=20is=20set?
I've=20been=20getting=20lots=20of=20spam=20with=20 images=20being=20displaye=
d,=20even=20though=20my
Outlook=202003=20is=20set=20to=20not=20download=20 pictures=20automatically.=
=20=20Here's=20what=20I
think=20is=20the=20relevant=20code=20(minus=20<=20and=20>):
DIV=20align=3Dcenter
FONT=20face=3DArial=20size=3D2
IMG=20src=3D"cid:kfhyepds_bfjhwcxn_dkiaarqo"
/FONT
/DIV
/BODY
/HTML
Any=20advice=20on=20how=20to=20deal=20with=20this? =20=20How=20does=20that=
=20"cid:=20.."=20translate=20into
a=20legitimate=20IP=20address=20from=20which=20to= 20pull=20an=20image?
Thanks!
---------------------------------------------------------------------------
Computer=20Forensics=20Training=20at=20the=20InfoS ec=20Institute.=20All=20o=
f=20our=20class=20sizes
are=20guaranteed=20to=20be=2012=20students=20or=20 less=20to=20facilitate=20=
one-on-one=20interaction
with=20one=20of=20our=20expert=20instructors.=20Ga in=20the=20in-demand=20sk=
ills=20of=20a=20certified
computer=20examiner,=20learn=20to=20recover=20trac e=20data=20left=20behind=
=20by=20fraud,=20theft,
and=20cybercrime=20perpetrators.=20Discover=20the= 20source=20of=20computer=
=20crime=20and=20abuse
so=20that=20it=20never=20happens=20again.
http://www.securityfocus.com/sponsor/InfoSecInstitute_security-basics_04081=
7
---------------------------------------------------------------------------=
-
---------------------------------------------------------------------------
Computer=20Forensics=20Training=20at=20the=20InfoS ec=20Institute.=20All=20o=
f=20our=20class=20sizes
are=20guaranteed=20to=20be=2012=20students=20or=20 less=20to=20facilitate=20=
one-on-one
interaction=20with=20one=20of=20our=20expert=20ins tructors.=20Gain=20the=20=
in-demand=20skills=20of
a=20certified=20computer=20examiner,=20learn=20to= 20recover=20trace=20data=
=20left=20behind=20by
fraud,=20theft,=20and=20cybercrime=20perpetrators. =20Discover=20the=20sourc=
e=20of=20computer
crime=20and=20abuse=20so=20that=20it=20never=20hap pens=20again.
http://www.infosecinstitute.com/courses/computer_forensics_training.html
---------------------------------------------------------------------------=
-
=20HTML=20e-mail=20containing=20an=20embedded=20malicious=20PN G=20image=20r=
eferenced=20locally=20using=20cid:=20as=20well,=20 if=20the=20recipient=20of=
=20the=20e-mail=20is=20using=20a=20vulnerable=20mail=20client .=20See
Chris=20Evans'=20security=20advisory
http://scary.beasts.org/security/CESA-2004-001.txt
Therefore=20this=20issue=20is=20somewhat=20serious ,=20and=20deserves=20more=
=20attention.=20Mail=20clients=20need=20to=20block =20automatic=20display=20=
of=20all=20images,=20not=20just=20those=20referenc ed=20by=20external=20URL=
=20inside=20an=20img=20tag.=20It=20is=20a=20lot=20 of=20work=20to=20locate=
=20vulnerable=20binary=20code,=20notify=20vendors= 20of=20vulnerable=20or=20=
flawed=20products=20and=20teach=20them=20this=20re medial=20basic=20security=
=20principle.=20I=20am=20looking=20for=20volunteer s=20who=20are=20intereste=
d=20in=20helping=20out=20with=20this=20effort.
Does=20anyone=20have=20a=20list=20of=20closed-source=20products=20known=20t=
o=20contain=20LIBPNG=20or=20code=20derived=20from= 20it=20that=20is=20believ=
ed=20vulnerable?
Most=20Secure=20Regards,
Jason=20Coombs
Director=20of=20Forensic=20Services
PivX=20Solutions,=20Inc.
Jcoombs@PivX.com
-----Original=20Message-----
From:=20"CHRIS=20GRABENSTEIN"=20<CGRABENSTEIN@lfcc.edu>
Date:=20Mon,=2023=20Aug=202004=2015:20:39=20
To:<security-basics@securityfocus.com>
Subject:=20RE:=20Images=20being=20pulled=20in=20Ou tlook=202003=20even=20tho=
ugh=20don't=20download=20pictures=20is=20set?
The=20reference=20after=20cid:=20refers=20to=20an= 20image=20embedded=20in=
=20the=20email=20itself.
The=20image=20arrives=20as=20part=20of=20the=20ema il=20rather=20than=20bein=
g=20pulled=20from=20a=20remote
server.
-----Original=20Message-----
From:=20Spencer,=20Mark=20[mailto:mspencer@evidentdata.com]=20
Sent:=20Sunday,=20August=2022,=202004=2012:36=20PM
To:=20security-basics@securityfocus.com
Subject:=20Images=20being=20pulled=20in=20Outlook= 202003=20even=20though=20=
don't=20download
pictures=20is=20set?
I've=20been=20getting=20lots=20of=20spam=20with=20 images=20being=20displaye=
d,=20even=20though=20my
Outlook=202003=20is=20set=20to=20not=20download=20 pictures=20automatically.=
=20=20Here's=20what=20I
think=20is=20the=20relevant=20code=20(minus=20<=20and=20>):
DIV=20align=3Dcenter
FONT=20face=3DArial=20size=3D2
IMG=20src=3D"cid:kfhyepds_bfjhwcxn_dkiaarqo"
/FONT
/DIV
/BODY
/HTML
Any=20advice=20on=20how=20to=20deal=20with=20this? =20=20How=20does=20that=
=20"cid:=20.."=20translate=20into
a=20legitimate=20IP=20address=20from=20which=20to= 20pull=20an=20image?
Thanks!
---------------------------------------------------------------------------
Computer=20Forensics=20Training=20at=20the=20InfoS ec=20Institute.=20All=20o=
f=20our=20class=20sizes
are=20guaranteed=20to=20be=2012=20students=20or=20 less=20to=20facilitate=20=
one-on-one=20interaction
with=20one=20of=20our=20expert=20instructors.=20Ga in=20the=20in-demand=20sk=
ills=20of=20a=20certified
computer=20examiner,=20learn=20to=20recover=20trac e=20data=20left=20behind=
=20by=20fraud,=20theft,
and=20cybercrime=20perpetrators.=20Discover=20the= 20source=20of=20computer=
=20crime=20and=20abuse
so=20that=20it=20never=20happens=20again.
http://www.securityfocus.com/sponsor/InfoSecInstitute_security-basics_04081=
7
---------------------------------------------------------------------------=
-
---------------------------------------------------------------------------
Computer=20Forensics=20Training=20at=20the=20InfoS ec=20Institute.=20All=20o=
f=20our=20class=20sizes
are=20guaranteed=20to=20be=2012=20students=20or=20 less=20to=20facilitate=20=
one-on-one
interaction=20with=20one=20of=20our=20expert=20ins tructors.=20Gain=20the=20=
in-demand=20skills=20of
a=20certified=20computer=20examiner,=20learn=20to= 20recover=20trace=20data=
=20left=20behind=20by
fraud,=20theft,=20and=20cybercrime=20perpetrators. =20Discover=20the=20sourc=
e=20of=20computer
crime=20and=20abuse=20so=20that=20it=20never=20hap pens=20again.
http://www.infosecinstitute.com/courses/computer_forensics_training.html
---------------------------------------------------------------------------=
-