upload an executable file disguised as gif or jpg

[aa]

If I allow people to upload GIF or JPG files on my site, is there a technical possibility to upload an executable file disguised as gif or jpg and execute it on my server?

 

[Bob Barrows]

If I allow people to upload GIF or JPG files on my site, is there a
technical possibility to upload an executable file disguised as gif
or jpg and execute it on my server?

I don't see how. Whether or not you are using a third-party component or a
pure asp solution to handle the upload, you are in control over what happens
to the file when it is processed in the server-side page.

I suppose there is a possibility of some type of malware being sent to a
client machine after it's been uploaded to the server (although I may be
wrong about this part).

You may get more details by asking on m.p.inetserver.iis.security. You may
want to do a Google search first. This may be a FAQ.

Bob Barrows

 

[aa]

Thanks, Bob.
I do not know what exactly is possible for a knowleadgeable hacker.
They make viruses built into email message which, when downloaded, start
doing some things.
This makes me think that one can write a virus camuflaged as a .gif file and
upload it to the server.

If I direct all uploads to a directory with no execution permissions, would
it prevent possible problems?

 

[Aaron Bertrand [MVP]]

They make viruses built into email message which, when downloaded, start

doing some things.

These have extensions that the operating system runs arbitrarily, such as
..pif or .scr. Not so with .gif or .jpg.

This makes me think that one can write a virus camuflaged as a .gif file and
upload it to the server.

No, can't really be done, since your operating system already knows what to
do with GIF files. The hacker would first have to alter your machine so
that it treated .GIF extension as something else. And this still wouldn't
affect your server, unless they altered the server that way, gained access
to the file system, and ran it. In which case, they wouldn't need to
disguise anything.

If I direct all uploads to a directory with no execution permissions, would
it prevent possible problems?

No, I assume you are worried about what happens when a user downloads the
file. If you put a file on your web server, anyone who accesses that file
via the web will be viewing it through their browser, or downloading it to
their machine.

 

[Guest]

It makes sense, thanks

 

[Ray at]

You're welcome.

?

Ray at work