Re: Image extension issue in mime.php

On Fri, Aug 22, 2008 at 2:13 AM, Thijs Kinkhorst <[email protected]> wrote:
> On Fri, August 22, 2008 10:03, Paul Lesniewski wrote:
>>> - IE interprets JavaScript when served within an "image" (that is,
>>> something linked from <img src="">. - Apparently (?) it doesn't do this
>>> when the file has a regular image extension, it then processes it as an
>>> image. A typical Windows way of working I guess.
>>>
>>
>> Hmm.  Can anyone confirm this?  Are there any sample URIs that we can
>> see for this?
>>
>> I tried this in IE6:
>>
>>
>> <img src='javascript:alert("hello")' />
>
> The linked image file should contain the JavaScript. E.g.:
> <img src='http://example.com/example.html' />
> and then example.html contains javascript instead of an image. IE will
> allegedly interpret the javascript in the file even though it has no
> business doing that as it is an image.

I see.  IE interprets any JavaScript loaded in a remote file unless
the extension is .png, .gif, etc....?  That's a bit much, now, isn't
it?  If this is what we are fighting, then the extension list by
definition of the way IE works seems like the ONLY way to prevent the
problem, that is unless we were to pre-fetch the content and scan it
ourselves and judge if the content was really an image file or not.

There may be a PHP algorithm out there already written to do that, so
*maybe* that is possible, but short of that, it looks like we are
stuck: have some HTML mails with blanks where images should really be
shown or open IE users up to possible attacks via this mechanism.

I am going to run a test to try to reproduce the actual IE issue you
described, and I am going to look around to see if there is a way we
can do a pre-fetch and make a content judgment.  Short of any other
ideas, though, it looks to me like the only thing we can do is let the
admin decide to open themselves up to this, or to build some 2nd level
of unsafe image viewing, where the user could click a *second* time to
show such images - but that may not be smart, since most users may not
understand the risk.

Oh, would it be safe to open SM up to any image URI as long as the
user agent is not IE?

Update - I just tried to use an image URI that loaded a php page that
serves this:

<script language="JavaScript" type="text/javascript">
alert("HELLO");
</script>

And in IE 6 it just gives a broken image (does NOT appear to interpret
the JavaScript!), as does FF.

Can anyone shed light on the actual vulnerability?

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel