>>Without having access to any of the information as to what web pages NetSec thinks is involved, >>but having seen many recent posts about the so-called "RFI - Russian IIS Hacks" I'd suggest >>that both reports are referring to one and the same, or at least, very closely related, things. >>... >>That is hardly the same thing as "embedded code hidden in graphics on Web pages"...
Yup, once I saw the SANS writeups I came to the same conclusion. So there's nothing really new in the client-side exploit and what's happening on the server hasn't been figured out yet, right? And it sounds like if you're up to date on patches and antivirus you're probably protected against the client-side exploit. Larry Seltzer _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
