GOOROO CROSSING: File Spoofing Internet Explorer 6

[http-equiv@excite.com]

Tuesday, January 27, 2004

Trivial file spoofing in Internet Explorer 6.0.2800.1106 and all
of 'its' patches to date on WIN XP [probably others]:

Content-Disposition: attachment; filename=malware.{3050f4d8-98B5-
11CF-BB82-00AA00BDCE0B}fun_ball_gites_pie_throw%2Empeg"

Absolute bare minimum working demo [perhaps even feeble] as we
are absolutely confident the self-appointed resident gooroo will
be along shortly handing out packets of two cents to everyone
thus saving us the effort to illustrate in even greater detail
to those lacking imagination:


http://www.malware.com/gooroo.html



End Call

--
http://www.malware.com

[Oliver Lavery]

For those who don't have their http-equiv speak secret-decoder-ring
with them, the GUID in this file extension causes the file to be treated =
as
an HTML Application instead of the mpeg file it 'appears' to be.

However, if you try out the 'demo', you'll see that you get prompted
with the standard IE Open/Save dialog box that warns the user that =
opening
files can be dangerous. That dialog doesn't list any file type for the =
file,
MPEG or otherwise. The only thing that's misleading is that the file =
appears
to have a .mpeg extension. If you save the file to disk, as opposed to
opening it directly, then it's treated as a .mpeg, as you would expect.

Personally I don't think this is much of an issue. This trick makes
a file _sort_of_ appear to be of a different type than it actually is.
Opening content from the web directly is dangerous, we all knew that
already. For this trick to be used as an attack vector, a user must
intervene and do something which is known to be dangerous, and labelled =
as
such. IE should proabably display the correct file-type 'HTML =
Application'
instead of leaving this part of the dialog blank.

The real problem is that IE makes it far too easy for users to run
executable content that's downloaded from the web. That's just a bad =
idea.=20

Cheers,
~x


> -----Original Message-----
> From: http-equiv@excite.com [mailto:1@malware.com]=20
> Sent: January 27, 2004 12:27 PM
> To: bugtraq@securityfocus.com
> Cc: NTBugtraq@listserv.ntbugtraq.com
> Subject: GOOROO CROSSING: File Spoofing Internet Explorer 6
>=20
>=20
>=20
>=20
> Tuesday, January 27, 2004=20
>=20
> Trivial file spoofing in Internet Explorer 6.0.2800.1106 and all=20
> of 'its' patches to date on WIN XP [probably others]:
>=20
> Content-Disposition: attachment;=20
> filename=3Dmalware.{3050f4d8-98B5-=20
> 11CF-BB82-00AA00BDCE0B}fun_ball_gites_pie_throw%2Empeg"
>=20
> Absolute bare minimum working demo [perhaps even feeble] as we=20
> are absolutely confident the self-appointed resident gooroo will=20
> be along shortly handing out packets of two cents to everyone=20
> thus saving us the effort to illustrate in even greater detail=20
> to those lacking imagination:
>=20
>=20
http://www.malware.com/gooroo.html



End Call

--=20
http://www.malware.com




---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.558 / Virus Database: 350 - Release Date: 02/01/2004
=20

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.558 / Virus Database: 350 - Release Date: 02/01/2004
=20

You're not very detailed about what happens behind the curtain, so here
goes

When an HTTP request returns its data, IE tries to determine the MIME
type based on several factors [0]. In this case, IE determines that it
cannot render the data as HTML since there is a Content-Disposition
header - Content-Disposition is used whenever you e.g. output a binary
file from a serverside script and want the filename to be displayed as
"ProjectScope.doc" instead of "download.php" (your scripts name).

The Content-Disposition HTTP header itself is not to blame, it is a
standard MIME header from RFC 1806 that has been widely implemented in
all browsers precisely to allow arbitrary filenaming.

Since IE cannot display the data itself, it displays the Open/SaveAs
dialog box so that the user can decide. The %2E in the filename is URL
decoded and displayed as a . (dot) in the dialog. This URL decoding
should simply not be performed as we are dealing with a file dialog and
not a URL dialog, if %2E had not been decoded we would not be having
this issue.

Whatever action the user takes is then handled by Windows Explorer, we
are now no longer dealing with IE. Windows Explorer determines what
application to open the data with based on lesser rules than Internet
Explorer, for one it does not look at the Content-Type header since it
does not know about it. The first step of action is to compare the file
extensions, only in the case of an unknown file extension does Windows
Explorer perform its "magic filetype" guessing by inspecting the files
content.

The file extension in Windows is no longer limited to 3 characters,
though historical reasons have kept most application extensions confined
to these. Windows Explorer parses the filename, excluding its path, and
determines that the file extension is everything following the last .
(dot) character, in this case ".{GUID}%2Efunny.mpeg". Common extensions
are either a set of printable characters or a GUID, with the latter
having priority over the former. After this, a lookup is performed in
the registry for HKCR\CLSID\.GUID and HKCR\.EXT, with EXT being the file
extension that we discovered and GUID the CLSID we found, and a match is
found for the GUID prior to the entire file extension. The GUID points
at "HTML Application" which points at MSHTA.EXE, which is then used to
display the data.

As with the ".Folder" issue, this definitely eases social engineering.
Internet Explorer should not URL decode strings for file dialogs and
Windows Explorer should not give precedence to CLSID's.


[0]
http://msdn.microsoft.com/workshop/n...view/appendix_
a.asp



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>=20



-----Original Message-----
From: http-equiv@excite.com [mailto:1@malware.com]=20
Sent: Tuesday, January 27, 2004 9:27 AM
To: bugtraq@securityfocus.com
Cc: NTBugtraq@listserv.ntbugtraq.com
Subject: GOOROO CROSSING: File Spoofing Internet Explorer 6




Tuesday, January 27, 2004=20

Trivial file spoofing in Internet Explorer 6.0.2800.1106 and all=20
of 'its' patches to date on WIN XP [probably others]:

Content-Disposition: attachment; filename=3Dmalware.{3050f4d8-98B5-
11CF-BB82-00AA00BDCE0B}fun_ball_gites_pie_throw%2Empeg"

Absolute bare minimum working demo [perhaps even feeble] as we=20
are absolutely confident the self-appointed resident gooroo will=20
be along shortly handing out packets of two cents to everyone=20
thus saving us the effort to illustrate in even greater detail=20
to those lacking imagination:


http://www.malware.com/gooroo.html



End Call

--=20
http://www.malware.com

[Dustin Furrer]

Seens how this really has'nt much to do with IE itself and is more of an
Explorer.exe bug\feature I'd say this was posted already and about a year
ago. We are already aware of this and of the fact that it affects just about
every aspect of the Operating System. Why the repost in a modified form?

Dustin