malicious jpeg shooting IE

[matto]

hi,

yesterday I encountered the strangest problem ...

on our site (a kind of game where registration with photo is required) someone uploaded some weird kind of malicious jpeg file which shot all our testing people's IE 6 (win xp) systems. it all started when the jpg was first fisplayed on the main page - there was just a blank rectangle. then, IE randomly refused to display gifs and jpegs from our site (mozilla did display them) until reboot. plus the systems slowed down notably.

I opened that image file in Paint Shop Pro and Photoshop and it displayed fine. note that I had it resized server-side with mogrify (imagemagick) before and this hadn't produced any errorcodes.

has someone heard of any IE exploit which fits to this description? I found nothing on the web. any ideas? and, most important: how can I have php sort out such files?

any suggestion is welcome. thanks in advance!

matto

[Weedpacket]

The only thing I can think of is that the JPEG came out of Photoshop 7, which has the option of embedding XML-encoded metadata into the jpeg file. While the result is perfectly valid according to the JPEG spec, there are applications out there (including IE) that aren't fully compliant with the spec.

You can take it two ways. Either Adobe is being too clever for its own good, or too many other software authors have finally been caught cutting corners.

As for a fix; dunno if it does, but if you can use ImageMagick to strip out extra "profile" blocks, then that will ditch the XML preview and the JPEG should thenceforth be safe. Another little Windows utility I know of that is designed to trim cruft off JPEG files and might do the job (can't give any guarantees) is JPEG Cleaner. Comes in both GUI and command-line variatns.

[matto]

thanks a lot, weedpacket - that must have been it!