Hi all,
The second issue in this advisory is the same as reported by Nesumin.
However, Secunia has been waiting for Opera Software to fix these
vulnerabilities and therefore, we have not released our research until
now.
Unfortunately, while we were waiting for the vendor fix, the second
vulnerability was discovered and disclosed by another party.
Our advisory can be found below.
Cheers,
Jakob Balle
--
======================================================================
Secunia Research 12/05/2003
- Opera browser filename extension buffer overflows -
======================================================================
Receive Secunia Security Advisories for free:
http://www.secunia.com/secunia_security_advisories/
======================================================================
Table of Contents
1....................................................Affected Software
2.............................................................Severity
3...............................................................Vendor
4.......................................Description of Vulnerabilities
5.............................................................Solution
6...........................................................Time Table
7..............................................................Credits
8........................................................About Secunia
9.........................................................Verification
======================================================================
1) Affected Software
Windows:
Opera browser 7.10 build 2840
Opera browser 7.03 build 2670
Linux:
Opera browser 7.1.0 Beta 1 build 388
Note: Versions prior to 7.03 may also be vulnerable.
======================================================================
2) Severity
Rating: Moderately critical
Impact: Potential system access, Denial of Service
Where: From remote
======================================================================
3) Vendor
Opera Software
Website:
http://www.opera.com/
======================================================================
4) Description of Vulnerabilities
The Opera browser does not handle long filename extensions correct.
This will allow a malicious person to cause a DoS or possible execute
arbitrary code with the privileges of the user.
Two different attack scenarios have been described below. However,
exploitation may also be possible in other ways.
Scenario 1:
Make the Opera browser generate the filename extension using an
unknown MIME type. If the Opera browser does not recognise the MIME
type it will use its subtype as filename extension. This will make it
possible to cause a stack overflow using the 'Download Dialog'.
The following version has been found vulnerable to this:
Opera 7.10 build 2840 for Windows
Example.
A)
Set the following headers:
Content-Type: application/AAAAA...[270]...AAAAA
Content-Disposition: attachment; filename=test
This will make the 'Download Dialog' occur with the fields:
File: test.AAAAA...[270]...AAAAA
Type: application/AAAAA...[270]...AAAAA
Opens with: test.AAAAA...[270]...AAAAA
B)
If the user clicks 'Save' in the 'Download Dialog' a buffer overflow
will occur on the stack and the following registers will be
overwritten: EIP and EBP
However, since the registers are overwritten with the Unicode value
of 'AA'(00410041) exploitation will be difficult.
Scenario 2:
Make the Opera browser download a file with a long filename extension.
This can be exploited to cause a DoS on the Opera browser. It was not
possible to determine whether or not this can be used to execute
arbitrary code.
The following versions has been found vulnerable:
Opera 7.10 Beta 1 for Linux
Opera 7.03 for Windows
Opera 7.10 for Windows
Example.
Set the following headers:
Content-Type: application/pdf
Content-Disposition: attachment; filename=.AAAAA...[270]...AAAAA
======================================================================
5) Solution
These vulnerabilities should be corrected in the latest version 7.11
Opera 7.11 for windows can be downloaded here:
http://www.opera.com/download/index.dml?platform=windows
Opera for Linux is still pending an update.
======================================================================
6) Time Table
18/04/2003 - Vulnerabilities discovered.
20/04/2003 - Further research.
22/04/2003 - Vendor notified.
28/04/2003 - Correspondence with vendor.
28/04/2003 - Irresponsible disclosure by other party.
29/04/2003 - Correspondence with vendor.
09/05/2003 - Vendor issued fixed version.
12/05/2003 - Information disclosed by Secunia.
======================================================================
7) Credits
Discovered by Jakob Balle, Secunia Research.
======================================================================
8) About Secunia
Secunia collects, validates, assesses and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://www.secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a free mailing list called Secunia Security Advisories:
http://www.secunia.com/secunia_security_advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://www.secunia.com/secunia_research/2003-4/
======================================================================
color=3Dblue face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial;color:blue'>and the data and =
images
are from first of Jan 2001 to =
date</span></font></p>
</div>
<div>
<p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D2 =
color=3Dblue face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial;color:blue'>Please let me =
Known </span></font></p>
</div>
<div>
<p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D3 =
face=3D"Times New Roman"><span
style=3D'font-size:12.0pt'> </span></font></p>
</div>
<div>
<p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D2 =
color=3Dblue face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial;color:blue'>Thanks</span></fo=
nt></p>
</div>
<div>
<p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D2 =
color=3Dblue face=3DArial><span
style=3D'font-size:10.0pt;font-family:Arial;color:blu
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Fri Jun 06 2003 - 10:52:02 PDT