Message-ID: <1052745669.3018.36.camel@localhost.localdomain>
Date: 12 May 2003 15:21:10 +0200
From: Jakob Balle <jb@...unia.com>
To: full-disclosure@...ts.netsys.com, vulnwatch@...nwatch.org,
   bugtraq@...urityfocus.com
Subject: Secunia Research: Opera browser filename extension buffer overflows


Hi all,

The second issue in this advisory is the same as reported by Nesumin.
However, Secunia has been waiting for Opera Software to fix these 
vulnerabilities and therefore, we have not released our research until
now.

Unfortunately, while we were waiting for the vendor fix, the second
vulnerability was discovered and disclosed by another party.

Our advisory can be found below.

Cheers,
Jakob Balle

--

======================================================================

                     Secunia Research 12/05/2003

         - Opera browser filename extension buffer overflows -         

======================================================================
Receive Secunia Security Advisories for free:
http://www.secunia.com/secunia_security_advisories/

======================================================================
Table of Contents
1....................................................Affected Software
2.............................................................Severity
3...............................................................Vendor
4.......................................Description of Vulnerabilities
5.............................................................Solution
6...........................................................Time Table
7..............................................................Credits
8........................................................About Secunia
9.........................................................Verification

======================================================================
1) Affected Software

Windows:
Opera browser 7.10 build 2840
Opera browser 7.03 build 2670

Linux:
Opera browser 7.1.0 Beta 1 build 388

Note: Versions prior to 7.03 may also be vulnerable.

======================================================================
2) Severity

Rating:  Moderately critical
Impact:  Potential system access, Denial of Service
Where:   From remote

======================================================================
3) Vendor

Opera Software

Website:
http://www.opera.com/

======================================================================
4) Description of Vulnerabilities

The Opera browser does not handle long filename extensions correct.
This will allow a malicious person to cause a DoS or possible execute
arbitrary code with the privileges of the user.

Two different attack scenarios have been described below. However, 
exploitation may also be possible in other ways.


Scenario 1:
Make the Opera browser generate the filename extension using an 
unknown MIME type. If the Opera browser does not recognise the MIME
type it will use its subtype as filename extension. This will make it
possible to cause a stack overflow using the 'Download Dialog'.

The following version has been found vulnerable to this:
Opera 7.10 build 2840 for Windows

Example.
A)
Set the following headers:
Content-Type: application/AAAAA...[270]...AAAAA
Content-Disposition: attachment; filename=test

This will make the 'Download Dialog' occur with the fields:
File:        test.AAAAA...[270]...AAAAA
Type:        application/AAAAA...[270]...AAAAA
Opens with:  test.AAAAA...[270]...AAAAA

B)
If the user clicks 'Save' in the 'Download Dialog' a buffer overflow 
will occur on the stack and the following registers will be 
overwritten: EIP and EBP
However, since the registers are overwritten with the Unicode value
of 'AA'(00410041) exploitation will be difficult.


Scenario 2:
Make the Opera browser download a file with a long filename extension.
This can be exploited to cause a DoS on the Opera browser. It was not
possible to determine whether or not this can be used to execute 
arbitrary code.

The following versions has been found vulnerable:
Opera 7.10 Beta 1 for Linux
Opera 7.03 for Windows
Opera 7.10 for Windows

Example.
Set the following headers:
Content-Type: application/pdf
Content-Disposition: attachment; filename=.AAAAA...[270]...AAAAA

======================================================================
5) Solution

These vulnerabilities should be corrected in the latest version 7.11

Opera 7.11 for windows can be downloaded here:
http://www.opera.com/download/index.dml?platform=windows

Opera for Linux is still pending an update.

======================================================================
6) Time Table

18/04/2003 - Vulnerabilities discovered.
20/04/2003 - Further research.
22/04/2003 - Vendor notified.
28/04/2003 - Correspondence with vendor.
28/04/2003 - Irresponsible disclosure by other party.
29/04/2003 - Correspondence with vendor.
09/05/2003 - Vendor issued fixed version.
12/05/2003 - Information disclosed by Secunia.

======================================================================
7) Credits

Discovered by Jakob Balle, Secunia Research.

======================================================================
8) About Secunia

Secunia collects, validates, assesses and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://www.secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a free mailing list called Secunia Security Advisories:

http://www.secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://www.secunia.com/secunia_research/2003-4/

======================================================================


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists