interesting firefox exploit (firedragging) - Techist - Tech Forum

Go Back   Techist - Tech Forum > Internet > Internet Software and Browsers
Click Here to Login
Closed Thread
 
Thread Tools Display Modes
 
Old 02-09-2005, 08:37 AM   #1 (permalink)
It's all just 1s and 0s
 
office politics's Avatar
 
Join Date: Jan 2004
Location: in the lab
Posts: 6,555
Send a message via MSN to office politics
Default interesting firefox exploit (firedragging)

from http://www.securityfocus.com/archive/1/389654

__Summary

Usually Firefox does not allow that an executable, non-image file gets
directly dragged to the desktop (e.g. by supplying malware.exe as the src of
an image tag). Instead Firefox creates a link to the file on the desktop.

If you create a hybrid of a gif image and a batch file you can trick
Firefox. Since the hybrid renders as a valid image, Firefox tries to copy
the image to the desktop when dropped. By creating the image dynamicly and
forcing the content type image/gif, the file can be of any extension (e.g.
image.bat or image.exe).

The windows batch file parser is pretty forgiving. It just ignores the first
line of "gif trash" and executes whatever you append to the end of the
hybrid file.

Since windows hides known file extensions by default, a user can only tell
that something went wrong by looking at the file icon, which is different of
course. If the user does not care or know what this different icon means, a
double click to view or edit the "image" he just dropped executes the batch
file instead.

__Proof-of-Concept

http://www.mikx.de/firedragging/

__Status

The bug is marked as fixed in bugzilla. Get a nightly build, compile on your
own or wait for Firefox 1.0.1.

2005-01-26 Vendor informed (bugzilla.mozilla.org #279945)
2005-01-31 Vendor confirmed bug
2005-02-03 Vendor fixed bug
2005-02-07 Public disclosure
__________________

office politics is offline  
Old 02-11-2005, 06:38 PM   #2 (permalink)
Ultra Techie
 
Join Date: Nov 2004
Posts: 902
Send a message via AIM to Sevoma
Default

ha. ha. I use linux suckers.

very interesting. They showed you exactly how to do it too.
__________________
<a href=\"http://truecombat.us\"><img src=\"http://www.truecombat.us/images/buttons/tcusbannersmall.jpg\"></a>

Sevoma Web Hosting
Sevoma is offline  
Closed Thread

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off




Copyright 2002- Social Knowledge, LLC All Rights Reserved.

All times are GMT -5. The time now is 08:25 PM.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2017, vBulletin Solutions, Inc.