[NT] Internet Explorer Code Execution Through MIME Manipulation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Internet Explorer Code Execution Through MIME Manipulation
------------------------------------------------------------------------

SUMMARY

Internet Explorer is unique in the way it handles files' content. Mainly
it does not handle the content based on the extension, rather based upon
the MIME detection engine built into the browser. An attacker can create a
file that contains active content (JavaScript etc) and give it a jpg
extension, then convince a user to access that so called image but instead
of the image being displayed the active content will be executed.

DETAILS

Vulnerable Systems:
* Microsoft Internet Explorer 6 and prior

Internet Explorer has been designed in such a way that it will use the
file's MIME type to identify its type rather than the file's extension
(for example: *.jpg).

This allows someone to cause a file that ends with jpg to not be processed
as an image file if the file's MIME type is different than the jpg.

Unfortunately, this allows attackers to create a file with active content
(e.g. Java or Javascript) and upload it with the extension of jpg to the
Internet, and then create a hyperlinked URL supposedly pointing to an
innocent jpg file.

Clicking on this link will load the file into the browser and will execute
whatever active content the attacker has written. The unsuspecting victim
would more than likely think that they are viewing a simple image file,
but instead they could be loading a silent JavaScript program.

Proof of Concept:
< img src=http://www.airscanner.com/images/logo.jpg>
< script>alert('Since when do JPEG images run active scripts?')< / script>
(c) Airscanner

Example:
<http://www.airscanner.com/security/images/IE_MIME.jpg>
http://www.airscanner.com/security/images/IE_MIME.jpg

Workaround:
* Disable Javascript support
* Disable image loading

ADDITIONAL INFORMATION

The information has been provided by
<mailto:fulldisclosure@fogieonline.com> Airscanner.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.