Internet Explorer File Download Extension Spoofing
- 0
- Add a Comment
- No Related Post
Description:
http-equiv has identified a vulnerability in Internet Explorer, allowing malicious web sites to spoof the file extension of downloadable files.
The problem is that Internet Explorer can be tricked into opening a file, with a different application than indicated by the file extension. This can be done by embedding a CLSID in the file name. This could be exploited to trick users into opening “trusted” file types which are in fact malicious files.
Secunia has created an online test: http://secunia.com/Internet_Explorer_Fil…
This has been reported to affect Microsoft Internet Explorer 6.
NOTE: Prior versions may also be affected.
Solution:
Do not use “Open” file, always save files to a folder as this reveals the suspicious filename