Signature Detail

HTTP: Executable Binary Disguised as Image

This signature detects attempts to download an executable binary file disguised as an image. Attackers can disguise a malicious program (executable binary file) as an image on a Web page. When a user downloads the image to the local Web cache using a Web browser, the image does not display (because it is not a valid image file). Attackers can then exploit additional vulnerabilities to trick the user into running the malicious file from the Web cache.

Extended Description

Mozilla Firefox is reported prone to a security vulnerability that could allow a malicious website to bypass drag-and-drop functionality security policies. A user can exploit this vulnerability with an image that renders correctly in the Firefox browser, but is saved with a '.bat' file extension when dragged and dropped onto the local filesystem. Since the batch file interpreter on Microsoft Windows is particularly lenient when it comes to syntax, batch commands appended to the image file will be executed if the image that was dragged and dropped is invoked. Update: Netscape 7.2 is reported vulnerable to this issue as well. Other versions may also be affected.

Affected Products

• Gentoo Linux
• HP HP-UX B.11.00
• HP HP-UX B.11.11
• HP HP-UX B.11.22
• HP HP-UX B.11.23
• Mozilla Browser 1.7.0
• Mozilla Browser 1.7.0 Alpha
• Mozilla Browser 1.7.0 Beta
• Mozilla Browser 1.7.0 Rc1
• Mozilla Browser 1.7.0 Rc2
• Mozilla Browser 1.7.0 Rc3
• Mozilla Browser 1.7.1
• Mozilla Browser 1.7.2
• Mozilla Browser 1.7.3
• Mozilla Browser 1.7.4
• Mozilla Browser 1.7.5
• Mozilla Firefox 0.10.0
• Mozilla Firefox 0.10.1
• Mozilla Firefox 0.8.0
• Mozilla Firefox 0.9.0
• Mozilla Firefox 0.9.0 Rc
• Mozilla Firefox 0.9.1
• Mozilla Firefox 0.9.2
• Mozilla Firefox 0.9.3
• Mozilla Firefox 1.0.0
• Mozilla Thunderbird 0.6.0
• Mozilla Thunderbird 0.7.0
• Mozilla Thunderbird 0.7.1
• Mozilla Thunderbird 0.7.2
• Mozilla Thunderbird 0.7.3
• Mozilla Thunderbird 0.8.0
• Mozilla Thunderbird 0.9.0
• Mozilla Thunderbird 1.0.0
• Mozilla Thunderbird 1.0.1
• Netscape 7.0.0
• Netscape 7.1.0
• Netscape 7.2.0
• SuSE Linux Personal 10.0.0 OSS
• SuSE Linux Personal 9.1.0
• SuSE Linux Personal 9.1.0 X86 64
• SuSE Linux Personal 9.2.0
• SuSE Linux Personal 9.2.0 X86 64
• SuSE Linux Personal 9.3.0
• SuSE Linux Personal 9.3.0 X86 64
• SuSE Linux Professional 10.0.0
• SuSE Linux Professional 10.0.0 OSS
• SuSE Linux Professional 9.1.0
• SuSE Linux Professional 9.1.0 X86 64
• SuSE Linux Professional 9.2.0
• SuSE Linux Professional 9.2.0 X86 64
• SuSE Linux Professional 9.3.0
• SuSE Linux Professional 9.3.0 X86 64

References

• BugTraq: 12468
• CVE: CVE-2005-0230
• URL: http://isc.sans.org/presentations/banking_malware.pdf