Re: Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations

[Gabriel Corona <gabriel.corona () free fr>]

Hi,

> > * Firefox and Thunderbird accept "special" MIME types (inode/* and
> >    x-scheme-handler/*) from remote servers;

> Not sure what you mean by “accept”.  Do you mean that download should be
> aborted?

No I mean that Firefox should ignore the Content-Type header for 
choosing an application to handle the file when such a special MIME type 
value is sent by the HTTP server.

Currently when using inode/directory or x-scheme-handler/trash, 
Firefox/Thunderbird proposes to use a file manager to handle the file. 
If the file manager tries to spawn another program to handle the file, 
this might be used to trick the user into thinking he is opening the 
file with a safe program.

A similar exploit might be possible if some application:

* is registered to handle a custom URI scheme (eg. "foo:");
* is not registered to handle regular files;
* can trigger arbitrary code execution when called with a regular file.

This might be expected to be safe. However an attacker might exploit 
this by serving a malicious file with x-scheme-handler/foo: Firefox will 
open the file using the application which will trigger the arbitrary 
code execution.

Regards,

Gabriel

Attachment: OpenPGP_signature
Description: OpenPGP digital signature