在最近的“黑帽子”(Black Hat)网上技术交流会上，有黑客宣称找到了能够在gif图片中隐藏可执行java文件的方法。
引用
During a recent webinar to promote the upcoming Black Hat briefings in Las Vegas, a group of hackers announced the creation of a hybrid file that can potentially bypass a browser’s same origin policy. They created a GIF file that also happens to be a JAR file ( a “GIFAR” file). Once uploaded onto a web site, and assuming the web server runs a JVM, it allows one to run a malicious java applet on someone else’s web server.
Details were not provided, since the hackers claim that Sun is still working on a patch. For more on hybrid (image) files as attack vectors, go to minute 41:23 of the webinar.
Details were not provided, since the hackers claim that Sun is still working on a patch. For more on hybrid (image) files as attack vectors, go to minute 41:23 of the webinar.
这种方法可以创建一个GIF图片文件，但同时也是也是一个JAR文件。当这样的文件被上传到网站，而该web服务器运行有JVM运行时，该恶意java Applet就会被执行。
黑客们没有提供具体细节，因为Sun正在准备相应的安全补丁。
来自：http://ajaxian.com/archives/evil-gifs-hiding-java-in-your-image
来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/14734416/viewspace-374285/ ，如需转载，请注明出处，否则将追究法律责任。
上一篇：
没有了~
下一篇：
七月开发语言排行榜出炉 Java蝉联冠军
请登录后发表评论
登录
全部评论
