The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords.

However, this struck me as unrealistic:


  Gragg's e-mail contained a poisoned JPEG of the brokerage logo. JPEGs were compressed image files. When the user viewed the e-mail, the operating system ran a decompression algorithm to render the graphic on-screen; it was this decompression algorithm that executed Gragg's malicious script and let him slip inside the user's system—granting him full access. There was a patch available for the decompression flaw, but older, rich folks typically had no clue about security patches.


Is there such a thing? Is this description based on some real exploit?

This was published in December 2006.

Is it sensible to say "the operating system" was decompressing the image to render it? 



Note this has nothing to do with security of PHP image uploading scripts.  I'm asking about the decoding process of displaying a JPEG, not scripts taking input from remote users, nor files misnamed as .jpeg.  The duplicate flagging I'm responding to looks poor even for a buzzword match; really nothing alike other than mentioning image files.


  Is there such a thing? 


Absolutely.  Feeding malicious input to a parser is one of the most common ways of creating an exploit (and, for a JPEG, "decompression" is "parsing").


  Is this description based on some real exploit?


It might be based on the Microsoft Windows GDI+ buffer overflow vulnerability:


  There is a buffer overflow vulnerability in the way the JPEG parsing
  component of GDI+ (Gdiplus.dll) handles malformed JPEG images. By
  introducing a specially crafted JPEG file to the vulnerable component,
  a remote attacker could trigger a buffer overflow condition.
  
  ...
  
  A remote, unauthenticated attacker could potentially execute arbitrary
  code on a vulnerable system by introducing a specially crafted JPEG
  file. This malicious JPEG image may be introduced to the system via a
  malicious web page, HTML email, or an email attachment.


.


  This was published in December 2006.


The GDI+ JPEG parsing vulnerability was published in September 2004.


  Is it sensible to say "the operating system" was decompressing the image to render it?


Sure; in this case, it was a system library that required an OS vendor patch to correct it.  Often such libraries are used by multiple software packages, making them part of the operating system rather than application-specific.

In actuality, "the email application invoked a system library to parse a JPEG," but "the operating system" is close enough for a novel.
