bugtraq - Opera 9.50 beta and prior remote DoS (freeze)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071205071359.11308.qmail@securityfocus.com>
Date: 5 Dec 2007 07:13:59 -0000
From: gynvael@...illium.org
To: bugtraq@...urityfocus.com
Subject: Opera 9.50 beta and prior remote DoS (freeze)

* Name   : Opera 9.50 beta / 9.24 Remote DoS
* Type   : Remote DoS
* Credits: Gynvael Coldwind of Vexillium  &  Simey
* Impact : Low

* Short description

Opera is vulnerable to a remote DoS attack, using spacially crafted BMP
files, that causes the browser to freeze for a short amount of time
(around 4 minutes on fast computer). An attacker could create a web
page that contains multiple BMP files displayed by an <img> tag. This
would freeze the browser for N*4 minutes, where N is the number of
images (so 100 images, the browser freezez for almost 7 hours). When
frozen, the browser consumes 100% CPU power.

* Verbose description

BMP file format allows Run Length Encoding in case of 4 and 8 bit
bitmaps. The RLE used in BMP format has additional features like
skipping the decompression write pointer to end of the line (bytes 00
00), skiping to the end of bitmap (00 01), and moving the write
pointer to another line and column (00 02 XX YY).

Opera has an ultra slow implementation of the 00 02 XX YY feature.
Normalny an decompression algorithm adds XX and YY * width to the
write pointer, but Opera has implemented a much slower way, with
additional check etc. The implementation performs XX + YY * width
incrementations (each with it's own checks and other calculations).

An attacker could use this fact to create a BMP file with maximum
possible width (in Opera this would be around 32000 pixels), and
the file's data should be filled with 00 02 FF FF opcodes (see
DoS_PoC/DoS_BMP_Generator/test10.cpp for a sample generator).

One malformed bitmap freezes the browser for some time. The time
depends on CPU speed. A simple benchmark tests have been performed:

CPU TYPE/SPEED                    TIME
Intel Core 2 Quad 2.4 GhZ         over 4 minutes
Intel Celeron M 1.6 GhZ           over 20 minutes

Through this time the browser is frozen, does not react to user
commands, and does not redraw it's content.

Additionally, the attacker could create a web page that contains
multiple images (<img> tag) to freeze the browser for N*OneFreezeTime
(where N is the number of images). See DoS_PoC/RunMe.html for a simple
example (10 bitmaps used). Please note that due to Opera's bitmap
caching, each bitmap should be named differently (for example
test1.bmp, test2.bmp, and so on).

* Proof of Concept

(This DoS'es the Opera, no warning is provided ;>)
http://gynvael.vexillium.org/opera_dos/

* Disclaimer

This document and all the information it contains is provided "as is",
without any warranty. The author is not responsible for the
misuse of the information provided in this advisory. The advisory is
provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing
that no changes are made and that the copyright notices and
disclaimers remain intact.