[22117] in bugtraq
SV: IE troubles with image files
daemon@ATHENA.MIT.EDU (Patrik Birgersson)
Sat Aug 4 13:31:42 2001
From: "Patrik Birgersson" <pbirgersson@telia.com>
To: "Hackemate.com.ar" <hackemate@softhome.net>, <bugtraq@securityfocus.com>
Cc: <vuln-dev@securityfocus.com>, <metalhack@yahoogroups.com>
Date: Sat, 4 Aug 2001 11:38:48 +0200
Message-ID: <OLEBJIFEPGKMPEEHJHKGMEBBCBAA.pbirgersson@telia.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
In-Reply-To: <4772.010803@softhome.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> If you rename a GIF or JPG file to TXT, IE
> can´t open it, it just stares and finishes cancelling.
> So IE can´t open TXTs files wich start with:
>
> GIF89a --->for gif files
> for jpgs i am not sure
I've tested this with IE 5.5 SP1 + Q299618.
Here are the results:
Two randomly chosen gif and jpg images were renamed to gif.txt and
jpg.txt respectivly.
TEST 1.
Trying to open images with File -> Open my notepad.exe is spawned and
displays the "content" of the images.
TEST 2.
Created a test.html document with links to the images:
<HTML>
<BODY>
<A HREF="gif.txt">GIF</A> <A HREF="jpg.txt">JPEG</A>
</BODY>
</HTML>
The "content" of the images were sucessfully displayed in the IE
window.
TEST 3.
Used the <IMG> tag to embed the images in the html page:
<HTML>
<BODY>
<IMG SRC="gif.txt"> <IMG SRC="jpg.txt">
</BODY>
</HTML>
Image placeholders were shown, but no images (wrong MIME type
according to extension).
TEST 4.
Renaming test.gif -> test.html and opening it in IE is displaying
parts of the image "content": GIF89aL9³ÿÿÿÿÀÀÀ óó+}|??/E;
MY CONCLUSION:
I couldn't reproduce what you experienced in IE 5.0, so I suppose
that this issue has been corrected by Microsoft (either in 5.5 or 5.5
SP1).
Thnx for your time :)
Patrik Birgersson
# Security is not a product - it is a process #
-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0
iQA/AwUBO2vCqB+A7LF3JdzkEQKK6ACcDTHZLXosNtUHQ39dlabX8cgtSJ0AoP68
7il970ToA4MPKo2vMLSXvSbd
=7j5A
-----END PGP SIGNATURE-----
