libgd Multiple Security Vulnerabilities

In a previous diary[1], I explained why the automatic processing of IOCs (Indicator of Compromise) could lead to false positives. Here is a practical example found yesterday. I captured the following malicious HTML page (MD5: b55a034d8e4eb4504dfce27c3dfc4ac3)[2]. It is part of a phishing campaign and tries to lure the victim to provide his/her credentials to get access to an Excel sheet. Nothing very dangerous for most people. It padding:5px 10px"> script type=text/javascript !-- document.write(unescape(%3c%68%74%6d%6c%3e%3c%68%65%61%64%3e ... ) //-- /script width:500px" />

Then, it renders the fake Excel sheet with a popup to enter an width:800px" />

The detected URLs are:

  • hxxp:// The dialog box
  • hxxp:// The fake Excel sheet

imgur.comis a pictureexchange platform and is regularly usedto host such material. But the third request is different and looks totally legit:

  • hxxp://

This last imageis an animated GIF that displays a loading bar (close to the Starting stringon the picture above).

There exists plenty of versions of this loader bar[3] and attackers like them. Its not unusual to see one on a malicious page to make it look more dynamic. The problem is that automation can categorize the website tennistonic.comas malicious and affect its reputation. If a tool decides to put the URL in alist of IOC padding:5px 10px"> RewriteEngine on RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)? [NC] RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

Take care!


Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Internet Storm Center Infocon Status