TITLE:
Microsoft Internet Explorer "Save Picture As" Image Download Spoofing
Vulnerability

SECUNIA ADVISORY ID:
SA13317

VERIFY ADVISORY:
http://secunia.com/advisories/13317/

CRITICAL:
Moderately critical

IMPACT:
Spoofing

WHERE:
>From remote

SOFTWARE:
Microsoft Internet Explorer 6
http://secunia.com/product/11/

DESCRIPTION:
cyber flash has discovered a vulnerability in Microsoft Internet
Explorer, which can be exploited by malicious people to trick users
into downloading malicious files.

The vulnerability is caused due to Internet Explorer using the file
extension from the URL's filename when saving images with the "Save
Picture As" command and also strips the last file extension if
multiple file extensions exist. This can be exploited by a malicious
web site to cause a valid image with malicious, embedded script code
to be saved with an arbitrary file extension.

Successful exploitation may allow a malicious web site to trick users
into downloading e.g. a malicious HTML Application (.hta) masqueraded
as a valid image. However, exploitation requires that the option
"Hide extension for known file types" is enabled (default setting).

The vulnerability has been confirmed on a fully patched system with
Internet Explorer 6.0 and Microsoft Windows XP SP2.

NOTE: A PoC (Proof of Concept) is publicly available.

SOLUTION:
Disable the "Hide extension for known file types" option.

PROVIDED AND/OR DISCOVERED BY:
cyber flash

OTHER REFERENCES:
"Right-Clicking, Selecting 'Save Picture As' Does Not Save Image with
Correct Extension":
http://support.microsoft.com/kb/250747

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------