Attempted User Privilege Gain

TObject · 2015-02-26, 21:11

Sometimes, when browsing these forums my IDS starts screaming about attempted user privilege gain attacks form the forum's IP.

* Directshow GIF logical width overflow attempt
* Directshow GIF logical height overflow attempt

Could be false positives.

I thought I would let you know...

LaurV · 2015-02-27, 05:59

Someone might have (intentional or not) malformed gifs as avatars, but I doubt, I assume that your toy doesn't know new (animated?) gif formats, and as it is a common practice for the mods here to play with people's avatars, adding mating unicorns or bully guys to them,

, usually by hand, it may be that some errors morphed into the headers of those avatars, making your tool to believe there is a buffer overflow intended... If you add frames to gifs but not modify the headers properly (some tools completely miss to do that!) this can happen. Someone with more rights than me may be able to insulate the problem, if any.

Xyzzy · 2015-02-27, 17:25

http://www.security-database.com/det...=CVE-2013-3174

Quote:

DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary Memory Overwrite Vulnerability."

2015-02-26, 21:11	#1
TObject Feb 2012 3⁴·5 Posts	Attempted User Privilege Gain Sometimes, when browsing these forums my IDS starts screaming about attempted user privilege gain attacks form the forum's IP. * Directshow GIF logical width overflow attempt * Directshow GIF logical height overflow attempt Could be false positives. I thought I would let you know...

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
ICC performance gain	testi	Msieve	5	2008-11-20 03:00
The user CP has gone :(	retina	Forum Feedback	5	2006-12-05 16:47
no speed gain in Prime95's benchmark when overclocking	forcemaker	Hardware	8	2006-04-02 15:18
OSX yet? new user here	KevinLee	Hardware	6	2003-12-12 17:06
5% performance gain running NFSNET + PRIME on a P 4 HT	TauCeti	Hardware	1	2003-07-02 22:22

2015-02-27, 05:59	#2
LaurV Romulan Interpreter Jun 2011 Thailand 2²×3³×89 Posts	Someone might have (intentional or not) malformed gifs as avatars, but I doubt, I assume that your toy doesn't know new (animated?) gif formats, and as it is a common practice for the mods here to play with people's avatars, adding mating unicorns or bully guys to them, , usually by hand, it may be that some errors morphed into the headers of those avatars, making your tool to believe there is a buffer overflow intended... If you add frames to gifs but not modify the headers properly (some tools completely miss to do that!) this can happen. Someone with more rights than me may be able to insulate the problem, if any.