Mozilla Foundation Security Advisory 2005-25
Image drag and drop executable spoofing
- Announced
- February 24, 2005
- Reporter
- Michael Krax
- Risk
- Moderate
- Impact
- Critical
- Products
- Firefox, Mozilla Suite, Thunderbird
- Fixed in
-
- Firefox 1.0.1
- Mozilla Suite 1.7.6
- Thunderbird 1.0.2
Description
Images dragged and dropped from a webpage to the desktop preserved their original name and extension. If this were an executable extension then the file would be executed rather than opened in a media application.
In order to exploit this the attacker would have to construct a valid image that was also a valid executable. On windows this can be done using a GIF image concatenated with a batch file. The attacker must convince the user to drag the image to their desktop and sometime later double click on it without noticing it has an executable icon rather than the expected media type image.
Workaround
Do not hide windows extensions. Be cautious downloading files from untrusted sites.