WARNING: MOAB includes hack attempt
Just a quick note, as we continue to look into this potentially critical issue further, but be warned that the current Month of Apple Bugs project seems to itself contain an attempt to exploit a vulnerability in the JPEG 2000 image format (.jp2). More info as we figure it out, but for now it’s recommended that you avoid the link to bug number 29. The page that is displayed by that link includes the following HTML lines:
  1. <img src="bug-files/heat-up.jp2" alt="" height="1" width="1" />
  2. <!-- Never use the macbook at bed again when browsing the MoAB or you will fry your balls, looper -->
The referenced .jp2 (JPEG 2000) file, when downloaded as part of rendering the HTML, causes at least some versions of Safari to hang up and require a force quit, and could do worse things as well.

Update, 1:00pm PST. It looks like the vulnerability may be specific to Safari, and that it’s a different JPEG 2000 vulnerability than
one Apple fixed in the 10.4.8 update (based on work here with the person who discovered and reported that bug previously). There’s also an ongoing discussion of this MOAB hack attempt on the group that has been attempting to fix the MOAB bugs as they’re discovered (see “Spy vs. spy”).
Tuesday, January 30, 2007