Editing Polyglot (computing) (section)

===GIFAR attack===

A '''Graphics Interchange Format Java Archives''' ('''GIFAR''') is a polyglot file that is simultaneously in the [[GIF]] and [[JAR (file format)|JAR]] file format.<ref>{{cite web |last1=Byrd |first1=Christopher |title=How to Create a GIFAR |url=https://www.riosec.com/articles/how-to-create-a-gifar |access-date=6 March 2023 |archive-date=6 March 2023 |archive-url=https://web.archive.org/web/20230306093631/https://www.riosec.com/articles/how-to-create-a-gifar |url-status=live }}</ref> This technique can be used to exploit security vulnerabilities, for example through uploading a GIFAR to a website that allows image uploading (as it is a valid GIF file), and then causing the Java portion of the GIFAR to be executed as though it were part of the website's intended code, being delivered to the browser from the [[Same-origin policy|same origin]].<ref>{{cite web |last1=Eckel |first1=Benjamin |title=The GIFAR Image Vulnerability |url=http://hackaday.com/2008/08/04/the-gifar-image-vulnerability |website=Hackaday |date=5 August 2008 |access-date=6 March 2023 |archive-date=6 March 2023 |archive-url=https://web.archive.org/web/20230306091403/https://hackaday.com/2008/08/04/the-gifar-image-vulnerability/ |url-status=live }}</ref> Java was patched in JRE 6 Update 11, with a CVE published in December 2008.<ref name="CVE-2008-5343">{{cite web |title=CVE-2008-5343 |url=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 |website=cve.mitre.org |access-date=20 April 2021 |date=2008-12-04 |archive-date=20 April 2021 |archive-url=https://web.archive.org/web/20210420204722/https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 |url-status=live }}</ref><ref>{{cite web | title=A photo that can steal your online credentials| url=http://www.infoworld.com/d/security-central/photo-can-steal-your-online-credentials-306| first=Robert| last=McMillan| date=August 1, 2008| publisher=Infoworld.com| archive-url= https://web.archive.org/web/20200918084425/https://www.infoworld.com/article/2653025/a-photo-that-can-steal-your-online-credentials.html| archive-date=2020-09-18}}</ref>

GIFARs are possible because GIF images store their header in the beginning of the file, and JAR files (as with any ZIP archive-based format) store their data at the end.<ref>{{cite web |last1=Rios |first1=Billy |title=Billy (BK) Rios » SUN Fixes GIFARs |url=http://xs-sniper.com/blog/2008/12/17/sun-fixes-gifars/ |access-date=20 April 2021 |archive-url=https://web.archive.org/web/20160314083259/http://xs-sniper.com/blog/2008/12/17/sun-fixes-gifars/ |archive-date=14 March 2016 |date=2008-12-17}}</ref>