On Mon, 15 May 2006, s89df987 s9f87s987f wrote:
you misunderstanding the usage
rgod has communicated with me offlist at that time and I understand the
issue.
--
Paul Laudanski, Microsoft MVP Windows-Security
[de] http://de.castlecops.com
[en] http://castlecops.com
[wiki]
On 5/13/06, Paul Laudanski [EMAIL PROTECTED] wrote:
I'd sure love to see the POC on this one. PHP by default needs exif to be
enabled during installation in order to work with the image meta data. So
in theory not enabling exif should cause this to be benign.
you misunderstanding the usage
On 12 May 2006 [EMAIL PROTECTED] wrote:
(3) inject some php code inside jpeg files as EXIF metadata content:
this, in combinations with third party vulnerable code can be used
to compromise the server where PHP is installed.
Should be enough to check for php code inside the temporary files
