full-disclosure - Unchecked Buffer in Opera 7.02

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <134344550000.20030410124032@netcabo.pt>
From: 0164455001 at netcabo.pt (0164455001)
Subject: Unchecked Buffer in Opera 7.02

Hello I.R.van,

Tuesday, April 8, 2003, 8:49:13 AM, you wrote:

> Opera 6.11 (Linux does not seem to be affected.

> ntentas descargar este archivo desde una p?gina gratuita de usuario de Tripod :
> http://usuarios.lycos.es/idoru/aaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.zip

> Para acceder a este archivo, necesitas visitar la p?gina del usuario:
> http://usuarios.lycos.es/idoru
> (ser?s remitido autom?ticamente a Lycos Tripod Espa?a en 5 segundos)

> My spanish isn't that good, but it seems I get a nice 404 page.

The page tell you to take the zip file from the main page
which is <http://usuarios.lycos.es/idoru>


> Greetings,

> Ivo van Dongen

> On Mon, 7 Apr 2003 22:39:26 -0300 (ART)
> "David F.Madrid" <conde0@...efonica.net> wrote:

>> 
>> Tested version : Opera 7.02 Build 2668
>> 
>> Vendor Status : Vendor was contacted on 8-4-2003
>> 
>> Description :
>> 
>> Opera web browser has an unchecked buffer in his code that allow a
>> malicious website to crash it and in certain circumstances , execute code
>> with user priviliges .
>> 
>> To reproduce the bug open this link
>> 
>> http://usuarios.lycos.es/idoru/aaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.zip
>> 
>> Opera crashes with an access violation . Instruction pointer EIP is
>> overwritten by the file name converted to unicode . That makes only
>> possible to reference certain addresses in memory to execute . To place
>> your code to execute in a valid address you have to assign it to an
>> enviroment variable .That place your code in an address that can be
>> referenced by EIP ( ~00010040 )
>> 
>> 
>> -- 
>> 
>> Regards ,
>> 
>> David F.Madrid
>> Madrid , Spain
>> 
>> 



 


-- 
Best regards,
 0164455001                      <mailto:0164455001@...cabo.pt>