RE: [Full-Disclosure] IE exploit runs code from graphics?

["Larry Seltzer" <larry@xxxxxxxxxxxxxxxx>]

>>Without having access to any of the information as to what web pages NetSec 
>>thinks is
involved, 
>>but having seen many recent posts about the so-called "RFI - Russian IIS 
>>Hacks" I'd
suggest 
>>that both reports are referring to one and the same, or at least, very closely
related, things.
>>...
>>That is hardly the same thing as "embedded code hidden in graphics on Web 
>>pages"...

Yup, once I saw the SANS writeups I came to the same conclusion. So there's 
nothing
really new in the client-side exploit and what's happening on the server hasn't 
been
figured out yet, right? And it sounds like if you're up to date on patches and 
antivirus
you're probably protected against the client-side exploit. 

Larry Seltzer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html