Comments on: IE finds JS in Images (old xss bug!)

By: Tim is now vocal. « domas mituzas: vaporware, inc.

Tim is now vocal. « domas mituzas: vaporware, inc. — Tue, 16 Dec 2008 10:51:49 +0000

[...] him at Wikimedia. Now he has a blog, where the first entry is already epic by any standards. I mentioned the IE bug, and Tim has done thorough analysis on this one, and similar [...]

By: kuza55

kuza55 — Sat, 25 Oct 2008 08:34:37 +0000

I just stumbled upon this page again, and I just had a look at the mediawiki fix you link to, and it’s vulnerable.

There are a bunch of other strings you need to filter (which I can’t past here due to wordpress filtering) and you need to check the first 256 bytes, rather than the first 200 bytes.

By: burah

burah — Fri, 01 Aug 2008 17:43:09 +0000

The link to the fix is broken. Is another file available elsewhere?

By: mmm

mmm — Mon, 07 Jan 2008 13:51:01 +0000

With PNG files – yes, it is fixed. With other types, e.g., PDF – still exists.

By: brion

brion — Sat, 05 Jan 2008 20:17:08 +0000

We can only hope that other XSS bugs can also be fixed in the same 3-year-plus time window. :)

By: kuza55

kuza55 — Fri, 04 Jan 2008 16:43:16 +0000

IE still does auto-detection, however they have recently added a signature for PNG files (in the MS07-057 patch), so valid PNG files will never be recognised as HTML any more.

Not that IE is perfect or anything, but this issue is not so much of an issue now that JPG/GIF/PNG files will never be detected as html.