Quote

What you should do is to first of all validate whether what you receive is a picture and then re-convert it. If it is JPG, convert it again to JPG, That way you force the library to rearrange the bits within the image and as such the junk at the bottom, which is the malicious JAR, will be removed. This is your safest option for now and for the future, unless you are using a very stringent image manipulation library.

Quote

Shrinking, converting, resizing, etc. will NOT necessarily fix this issue as is being suggested on Slashdot. We have been able to attack sites that do resizing, shrinking, or converting as well.

Quote

The way to fix this is to either:
* Sanitize the incoming content to make sure it is not a combined file (this is extremely hard to do properly).
* Host the images on a different domain (and I do not mean a different sub-domain). For example, if the image is hosted from images.mysite.com, we can still attack www.mysite.com; however, if the image is hosted from images4mysite.com, we cannot attack www.mysite.com unless we find a different upload vector that places us on the mysite.com domain.