About: Gifar

Facets (new session)
Description
Metadata
Settings
- Rule:
- Inverse Functional Properties:
- "Same As":

About: Gifar Goto Sponge NotDistinct Permalink

An Entity of Type : yago:WikicatGraphicsFileFormats, within Data Space : dbpedia.demo.openlinksw.com associated with source document(s)
QRcode icon

http://dbpedia.demo.openlinksw.com/describe/?url=http%3A%2F%2Fdbpedia.org%2Fresource%2FGifar

Graphics Interchange Format Java Archives (GIFAR) is a term for GIF files combined with the JAR file format. GIFARs could be uploaded to Web sites that allow image uploading, and then run as though they were part of the legitimate code of that site. Java was patched in JRE 6 Update 11, with a CVE published on December 4 2008. A GIFAR allowed an attacker to access the victim's HTTP cookies. This allows session hijacking, where the victim's logged-in user accounts can be accessed. For the attack to work, the victim must be logged into the Web site that is hosting the image.

Attributes	Values
rdf:type	yago:WikicatArchiveFormats yago:Abstraction100002137 yago:Communication100033020 yago:Format106636806 yago:Information106634376 yago:Message106598915 yago:WikicatGraphicsFileFormats
rdfs:label	Gifar (en)
rdfs:comment	Graphics Interchange Format Java Archives (GIFAR) is a term for GIF files combined with the JAR file format. GIFARs could be uploaded to Web sites that allow image uploading, and then run as though they were part of the legitimate code of that site. Java was patched in JRE 6 Update 11, with a CVE published on December 4 2008. A GIFAR allowed an attacker to access the victim's HTTP cookies. This allows session hijacking, where the victim's logged-in user accounts can be accessed. For the attack to work, the victim must be logged into the Web site that is hosting the image. (en)
foaf:depiction
dcterms:subject	Archive formats Graphics file formats Java platform Computer security
Wikipage page ID	35531531 (xsd:integer)
Wikipage revision ID	1108689614 (xsd:integer)
Link from a Wikipage to another Wikipage	HTTP cookies JAR (file format) Archive formats Graphics file formats CompuServe Same-origin policy GIF Mosaic (web browser) Computer animation Data compression Java platform Digital signature Raster graphics Run-length encoding JPEG Java Development Kit Computer security Image file formats Session hijacking World Wide Web Lempel-Ziv-Welch Lossless data compression ZIP archive XBM
Link from a Wikipage to an external page	http://riosec.com/how-to-create-a-gifar http://securethoughts.com/2009/01/easy-server-side-fix-for-the-gifar-security-issue http://www.cis.udel.edu/%7Eamer/CISC651/lzw.and.gif.explained.html http://hackaday.com/2008/08/04/the-gifar-image-vulnerability http://download.oracle.com/javase/6/docs/technotes/guides/jar/jarGuide.html
sameAs	Gifar Gifar Gifar Gifar
dbp:wikiPageUsesTemplate	dbt:Merge_to dbt:More_citations_needed dbt:Reflist
thumbnail	wiki-commons:Special:FilePath/This_technique_worked_because_GIF_images_store_their_header_in_the_beginning_of_the_file,_and_JAR_files_(as_with_any_ZIP_archive-based_format)_store_their_data_at_the_tail._This_attack_is_not_unique_to_GIFs_and_JARs;_there_is_a_general_class_of_vulnerabilities_of_file_type_combinations_such_as_.doc,_.jpg?width=300
colwidth	30 (xsd:integer)
has abstract	Graphics Interchange Format Java Archives (GIFAR) is a term for GIF files combined with the JAR file format. GIFARs could be uploaded to Web sites that allow image uploading, and then run as though they were part of the legitimate code of that site. Java was patched in JRE 6 Update 11, with a CVE published on December 4 2008. In this attack, GIF Java archive files (GIFARs) were uploaded to Web sites on the understanding that they are GIFs, and the file was then interpreted as a JAR file when viewed and executed. This circumvented the same-origin policy that browsers impose; bypassing the content validation usually used. Attackers reference this malicious image in the applet code on the hosted site, establishing cross-domain communication with the (your) target domain. This technique worked because GIF images store their header in the beginning of the file, and JAR files (as with any ZIP archive-based format) store their data at the tail. This attack is not unique to GIFs and JARs; there is a general class of vulnerabilities of file type combinations such as .doc, .jpg, etc. A GIFAR allowed an attacker to access the victim's HTTP cookies. This allows session hijacking, where the victim's logged-in user accounts can be accessed. GIFARs should not have been executed if the user is viewing the image; it had to be interpreted as a JAR not a GIF to run. For the attack to work, the victim must be logged into the Web site that is hosting the image. Any site that includes login sessions with user-uploaded pictures can be vulnerable. (en)
gold:hypernym	Malware
prov:wasDerivedFrom	wikipedia-en:Gifar?oldid=1108689614&ns=0
page length (characters) of wiki page	9639 (xsd:nonNegativeInteger)
foaf:isPrimaryTopicOf	wikipedia-en:Gifar
is Link from a Wikipage to another Wikipage of	JAR (file format) GIFAR
is Wikipage redirect of	GIFAR
is foaf:primaryTopic of	wikipedia-en:Gifar

Faceted Search & Find service v1.17_git139 as of Feb 29 2024

Alternative Linked Data Documents: ODE Content Formats:

RDF

ODATA

Microdata

About

OpenLink Virtuoso version 08.03.3330 as of Mar 19 2024, on Linux (x86_64-generic-linux-glibc212), Single-Server Edition (378 GB total memory, 59 GB memory in use)
Data on this page belongs to its respective rights holders.
Virtuoso Faceted Browser Copyright © 2009-2024 OpenLink Software