[Freeswitch-users] faxploit

[mayamatakeshi]

On Wed, Aug 26, 2020 at 2:47 AM Brian West <brian at freeswitch.com> wrote:

> Spoke with Steve,
>
> He says:
>
> What is described there does not appear to be a problem with the FAX
> protocol, even though the text says it is. They refer to problems
> handling DHT (define huffman table) and COM (comment) sections when they
> are used incorrectly. Those are tags in JPEG images. It looks like that
> are talking about an issue with JPEG decoders that don't allow for
> certain types of corrupt image, and the exploit would be specific to
> particular models of FAX machines. The problem would be in the JPEG
> decoder itself. Spandsp calls the system's JPEG library to do that
> decoding. Any flaw that might exist would be in that system's JPEG library.
>
>
>
Steve and Brian,
thanks.
Yes, that's it:

*While their research was undoubtedly eye-opening, similar headlines and
statements claiming that the “T.30 protocol itself has been compromised” *

*are categorically false; a bit of drama designed to make headlines. More
specifically, the researches were able to demonstrate the Faxploit by
exposing *

*a flaw in software developed internally at HP, rendering it vulnerable
when handling color/JPEG faxes. *

https://www.ingeniumsw.com/news-press/faxploit/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20200826/33c1163f/attachment.html>