======================================================================

                     Secunia Research 01/03/2005

    - Mozilla / Firefox "Save Link As" Download Dialog Spoofing -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

Mozilla Firefox 1.0 for Windows
Mozilla 1.7.3 for Windows

Other versions may also be affected.

======================================================================
2) Severity

Rating: Less critical
Impact: Spoofing
Where:  From remote

======================================================================
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in Mozilla and 
Mozilla Firefox, which can be exploited by malicious people to trick 
users into downloading malicious files.

The problem is that the browser uses the URL to determine the file 
type association in the "Save Link As" download dialog, but uses the 
filename from the "Content-Disposition" HTTP header when saving the 
downloaded file. This can be exploited by a malicious website to 
spoof file types in the "Save Link As" download dialog.

Successful exploitation can lead to malware being saved to the 
download directory (default is the desktop on Mozilla Firefox).

NOTE: Exploitation requires that the option 
"Hide extension for known file types" is enabled in Windows 
(default setting).

The vulnerability has been confirmed in Mozilla 1.7.3 and 
Mozilla Firefox 1.0 for Windows. Other versions may also be 
affected.

======================================================================
4) Solution

Mozilla Firefox:
Update to version 1.0.1.
http://www.mozilla.org/products/firefox/

Mozilla:
Update to version 1.7.5.
http://www.mozilla.org/products/mozilla1.x/

======================================================================
5) Time Table

26/11/2004 - Vendor notified.
07/12/2004 - Vendor confirms the vulnerability.
10/12/2004 - Vulnerability fixed in the CVS repository.
17/12/2004 - Mozilla 1.7.5 released.
25/02/2005 - Mozilla Firefox 1.0.1 released.
01/03/2005 - Public disclosure.

======================================================================
6) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
7) References

Bugzilla reference:
https://bugzilla.mozilla.org/show_bug.cgi?id=273498

Mozilla:
http://www.mozilla.org/security/announce/mfsa2005-22.html

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia web site:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia web site:
http://secunia.com/secunia_research/2004-21/advisory/

Complete list of vulnerability reports released by Secunia Research:
http://secunia.com/secunia_research/

=====================================================================