[33335] in bugtraq
another Trojan with the ADO hole? + a twist in the story
daemon@ATHENA.MIT.EDU (Gadi Evron)
Mon Feb 2 23:34:50 2004
Message-ID: <401BE74A.3000109@egotistical.reprehensible.net>
Date: Sat, 31 Jan 2004 19:35:06 +0200
From: Gadi Evron <ge@egotistical.reprehensible.net>
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
The past Trojan horses which spread this way took advantage of the fact
web servers send an HTML 404 message if a file doesn't exist.
The original sample - britney.jpg - was simply an html file itself, and
using that fact, and IE loading it. It was combined with one of the
latest exploits of the time (I don't think MS patched it yet), and
downloaded the Trojan horses.
This time around there is actually a picture on the web page, of a real
honest to God girl. But in another frame.. the same story all over again.
For blocking purposes, the (un-safe) URL is: http://ut.uk.to/cs.jpg .
Gadi Evron.
