3 ms·
The loader hook could well be in your .profile. Or the infection vector could be a naughty PDF just waiting to be thumbnailed again after a reinstall.
by tedunangst 9y ago
The loader hook could well be in your .profile. Or the infection vector could be a naughty PDF just waiting to be thumbnailed again after a reinstall.
- bogomipz 9y agoCould you elaborate are you referring to a specific PDF vulnerability? Could you share a link to it? Thanks.
- therein 9y agoThis should do: > In the first demo, I just select the PDF document with one click. This is enough to exploit the vulnerability, because the PDF document is implicitly read to gather extra information. > In the second demo, I change the view to Thumbnails view. In a thumbnail view, the first page of a PDF document is rendered to be displayed in a thumbnail. Rendering the first page implies reading the PDF document, and hence triggering the vulnerability. > In the third demo, I use my special PDF document with the malformed stream object in the metadata. When I hover with the mouse cursor over the document (I don’t click), a tooltip will appear with the file properties and metadata. But with my specially crafted PDF document, the vulnerability is triggered because the metadata is read to display the tooltip… https://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/ https://blog.didierstevens.com/2009/03/04/quickpost-jbig2dec...