Image Download Spoofing in Microsoft Internet Expl

[Mobo]

11/26/2004

Description:

cyber flash has discovered a vulnerability in Microsoft Internet Explorer, which can be exploited by malicious people to trick users into downloading malicious files.

The vulnerability is caused due to Internet Explorer using the file extension from the URL's filename when saving images with the "Save Picture As" command and also strips the last file extension if multiple file extensions exist. This can be exploited by a malicious web site to cause a valid image with malicious, embedded script code to be saved with an arbitrary file extension.

Successful exploitation may allow a malicious web site to trick users into downloading e.g. a malicious HTML Application (.hta) masqueraded as a valid image. However, exploitation requires that the option "Hide extension for known file types" is enabled (default setting).

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2.

NOTE: A PoC (Proof of Concept) is publicly available.


Solution:
Disable the "Hide extension for known file types" option.