[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <134344550000.20030410124032@netcabo.pt>
From: 0164455001 at netcabo.pt (0164455001)
Subject: Unchecked Buffer in Opera 7.02
Hello I.R.van,
Tuesday, April 8, 2003, 8:49:13 AM, you wrote:
> Opera 6.11 (Linux does not seem to be affected.
> ntentas descargar este archivo desde una p?gina gratuita de usuario de Tripod :
> http://usuarios.lycos.es/idoru/aaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.zip
> Para acceder a este archivo, necesitas visitar la p?gina del usuario:
> http://usuarios.lycos.es/idoru
> (ser?s remitido autom?ticamente a Lycos Tripod Espa?a en 5 segundos)
> My spanish isn't that good, but it seems I get a nice 404 page.
The page tell you to take the zip file from the main page
which is <http://usuarios.lycos.es/idoru>
> Greetings,
> Ivo van Dongen
> On Mon, 7 Apr 2003 22:39:26 -0300 (ART)
> "David F.Madrid" <conde0@...efonica.net> wrote:
>>
>> Tested version : Opera 7.02 Build 2668
>>
>> Vendor Status : Vendor was contacted on 8-4-2003
>>
>> Description :
>>
>> Opera web browser has an unchecked buffer in his code that allow a
>> malicious website to crash it and in certain circumstances , execute code
>> with user priviliges .
>>
>> To reproduce the bug open this link
>>
>> http://usuarios.lycos.es/idoru/aaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.zip
>>
>> Opera crashes with an access violation . Instruction pointer EIP is
>> overwritten by the file name converted to unicode . That makes only
>> possible to reference certain addresses in memory to execute . To place
>> your code to execute in a valid address you have to assign it to an
>> enviroment variable .That place your code in an address that can be
>> referenced by EIP ( ~00010040 )
>>
>>
>> --
>>
>> Regards ,
>>
>> David F.Madrid
>> Madrid , Spain
>>
>>
--
Best regards,
0164455001 <mailto:0164455001@...cabo.pt>
Powered by blists - more mailing lists