Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2005-25

Image drag and drop executable spoofing

Announced
February 24, 2005
Reporter
Michael Krax
Risk
Moderate
Impact
Critical
Products
Firefox, Mozilla Suite, Thunderbird
Fixed in
  • Firefox 1.0.1
  • Mozilla Suite 1.7.6
  • Thunderbird 1.0.2

Description

Images dragged and dropped from a webpage to the desktop preserved their original name and extension. If this were an executable extension then the file would be executed rather than opened in a media application.

In order to exploit this the attacker would have to construct a valid image that was also a valid executable. On windows this can be done using a GIF image concatenated with a batch file. The attacker must convince the user to drag the image to their desktop and sometime later double click on it without noticing it has an executable icon rather than the expected media type image.

Workaround

Do not hide windows extensions. Be cautious downloading files from untrusted sites.

References