Microsoft IE File Extension Spoofing Vulnerability (MS01-058)

Key Information Summary Vulnerability Overview Vulnerability Description: Microsoft Internet Explorer contains a flaw in how it processes specific HTTP response strings, allowing websites to forge the names of requested files and disguise them as harmless files. This vulnerability could enable automatic download and execution of program files without any user interaction or decision. Impact Scope: Accessing malicious websites or opening HTML emails may lead to system compromise. Affected Versions: Testing revealed that IE 6, 5.5, and 5.0 are all affected. IE 5.5 SP2 does not automatically download and execute .exe files, but may still be vulnerable to variants (different MIME types or HTTP header content). Affected Versions Details The vulnerability stems from how IE handles Content-type and Content-disposition HTTP headers. By crafting specific response strings, the browser can be tricked into downloading and executing files without user confirmation. This technique also misleads browser logic, triggering automatic execution of programs. Mitigation If patches cannot be applied, disable file download functionality to prevent attacks. Temporary workaround: Use browsers unaffected by this issue, such as Opera or Netscape. Vendor Response Initial notification to Microsoft regarding the "file extension spoofing" issue on November 19. Notification of a new variant on November 27, prompting Microsoft to begin remediation efforts. Patch has been released and is available for download at: http://www.microsoft.com/technet/security/bulletin/MS01-058.asp

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft IE File Extension Spoofing Vulnerability (MS01-058)