[NT] Internet Explorer Code Execution Through MIME Manipulation

From: SecuriTeam (support_at_securiteam.com)
Date: 08/14/05

  • Next message: SecuriTeam: "[NEWS] Default Configuration Information Disclosure in Lotus Domino (Including Password Hashes)" 
    To: list@securiteam.com
Date: 14 Aug 2005 17:34:19 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Internet Explorer Code Execution Through MIME Manipulation
    ------------------------------------------------------------------------

    SUMMARY

    Internet Explorer is unique in the way it handles files' content. Mainly
    it does not handle the content based on the extension, rather based upon
    the MIME detection engine built into the browser. An attacker can create a
    file that contains active content (JavaScript etc) and give it a jpg
    extension, then convince a user to access that so called image but instead
    of the image being displayed the active content will be executed.

    DETAILS

    Vulnerable Systems:
     * Microsoft Internet Explorer 6 and prior

    Internet Explorer has been designed in such a way that it will use the
    file's MIME type to identify its type rather than the file's extension
    (for example: *.jpg).

    This allows someone to cause a file that ends with jpg to not be processed
    as an image file if the file's MIME type is different than the jpg.

    Unfortunately, this allows attackers to create a file with active content
    (e.g. Java or Javascript) and upload it with the extension of jpg to the
    Internet, and then create a hyperlinked URL supposedly pointing to an
    innocent jpg file.

    Clicking on this link will load the file into the browser and will execute
    whatever active content the attacker has written. The unsuspecting victim
    would more than likely think that they are viewing a simple image file,
    but instead they could be loading a silent JavaScript program.

    Proof of Concept:
    < img src=http://www.airscanner.com/images/logo.jpg>
    < script>alert('Since when do JPEG images run active scripts?')< / script>
    (c) Airscanner

    Example:
     <http://www.airscanner.com/security/images/IE_MIME.jpg>
    http://www.airscanner.com/security/images/IE_MIME.jpg

    Workaround:
     * Disable Javascript support
     * Disable image loading

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:fulldisclosure@fogieonline.com> Airscanner.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Default Configuration Information Disclosure in Lotus Domino (Including Password Hashes)"

    Relevant Pages