This is an open bug. (One which is rather disturbing, so I am
not sure why Microsoft has chosen to not fix it.)

Date: 21 October 2001=20
http://www.guninski.com/popspoof.html

"Demonstration:=20

Image moving over download/open dialog:=20
http://www.guninski.com/opf2.html "


=20

> -----Original Message-----
> From: Paul [mailtoaul@greyhats.cjb.net]=20
> Sent: Sunday, July 11, 2004 8:52 AM
> To: bugtraq@securityfocus.com
> Subject: MSIE Download Window Filename + Filetype Spoofing=20
> Vulnerability
>=20
>=20
>=20
> Note: This vulnerability as well as several more can be found=20
> at http://www.greyhats.cjb.net
>=20
>=20
>=20
> Download Window Filename + Filetype Spoofing Vulnerability=20
>=20
>=20
>=20
> [Tested]
>=20
> IEXPLORE.EXE file version 6.0.2800.1106
>=20
> MSHTML.DLL file version 6.00.2800.1400
>=20
> Microsoft Windows XP sp2=20
>=20
>=20
>=20
> [Discussion]
>=20
> When a webpage offers a file who's mime type can't be opened=20
> in a browser, Internet Explorer usually displays a download=20
> window with the filename and its type. Previous=20
> vulnerabilities have been used to spoof the filename so the=20
> victim thinks the file is something it isn't. This is one of=20
> those vulnerabilities.=20
>=20
>=20
>=20
> Window.createPopup() creates a popup that goes on top of=20
> every other window. This includes applications other than=20
> internet explorer. This doesn't seem like the greatest idea,=20
> but it could be useful if you want to get urgent information=20
> out to someone. By placing the popup in a certain location,=20
> we can cover up the filename and its type in the download=20
> window and replace it with our own. One more thing, we need=20
> to set the popup's onoffload to open itself back up, because=20
> if the parent window is clicked after a popup opens, the=20
> popup is closed.=20
>=20
>=20
>=20
> The example tells internet explorer to download badfile.exe,=20
> which of course is an 'Application'. A popup is then opened=20
> covering up the filename and type and replaces it with=20
> 'sexycoeds.jpg' (GGW commercial was on when I was writing=20
> this which is a 'JPEG Image'. The viewer should press=20
> 'open' to view the sexy coeds right away, which will download=20
> and run badfile.exe. If you want, you can name the executable=20
> sexycoeds.exe and change the icon so if the user presses=20
> 'save' windows should hide the extension and it will still=20
> look like a jpg image.=20
>=20
>=20
>=20
> [Example]
>=20
> http://freehost07.websamba.com/greyhats/dlwinspoof.htm
>=20