On older browsers, the answer is yes, this kind of attack is possible, due to some browsers' support for MIME content-type sniffing. You can Google for content-sniffing attacks and you'll find a lot more details.
To defend against it, set the header
X-Content-Type-Options: nosniff (only supported on IE8 and IE9, I think), and make sure to serve a valid content-type in the
Content-Type: header. Those will disable content-type sniffing on many browsers (on IE8, IE9, and non-IE browsers, at least).
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?,
Does X-Content-Type-Options really prevent content sniffing attacks?,
What are the security risks of letting the users upload content to my site?,
How can I be protected from pictures vulnerabilities?,
Is it safe to serve any user uploaded file under only white-listed MIME content types?,
MIME sniffing protection,
Why should I restrict the content type of files be uploaded to my site?.
I also recommend that you serve user-uploaded content from a separate domain, to sandbox the user content and ensure it cannot tamper with your content. For instance, you might host your content on
www.example.com and host user-provided content on
Update: I just learned that setting the
X-Content-Type-Options headers are not enough for security. Apparently, Flash ignores the Content-Type header, which could allow loading a malicious SWF, which can then do everything you'd do with a XSS. (Sigh, stupid Flash.) Unfortunately, no amount of headers can stop this attack. Consequently, it appears that the only safe solution is to host the user-uploaded content on a separate domain.