full-disclosure - iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1084444564.15702.131.camel@localhost.localdomain>
From: jb at secunia.com (Jakob Balle)
Subject: iDEFENSE Security Advisory 05.12.04: Opera
	Telnet URI Handler File Creation/Truncation Vulnerability

Another minor issue has also been corrected in Opera Browser version
7.50, allowing malicious websites to spoof the address bar. 

The solutions remains the same, therefore no need to paste our full
advisory here. However, if you wish further details, they can be found
at:
http://secunia.com/secunia_research/2004-2/
http://secunia.com/advisories/11532/


Best regards,

Jakob Balle, Secunia



On Wed, 2004-05-12 at 20:54, idlabs-advisories@...fense.com wrote:
> Opera Telnet URI Handler File Creation/Truncation Vulnerability
> 
> iDEFENSE Security Advisory 05.12.04
> www.idefense.com/application/poi/display?id=104&type=vulnerabilities
> May 12, 2004
> 
> I. BACKGROUND
> 
> Opera is a cross-platform web browser. More information is available
> from http://www.opera.com/
> 
> II. DESCRIPTION
> 
> Exploitation of an input validation vulnerability within Opera Software
> ASA.'s Opera Web Browser could allow remote attackers to create or
> truncate arbitrary files.
> 
> The problem specifically exists within the telnet URI handler. Opera
> does not check for '-' at the beginning of hostname passed through the
> handler, which lets options pass to the telnet program, allowing file
> creation or overwriting. Under Windows XP, when telnet.exe is executed
> with the '-f' option, the remainder of the argument is used as a
> filename for logging the connection. Under Linux, the '-n' option
> creates a 'tracefile' for the connection. These options create a file if
> it does not exist, or truncates it if it does.
> 
> If a telnet: URI with the appropriate option is opened, a file will be
> created in the current working directory of the Opera process if the
> user has permission. In Windows, this defaults to the directory Opera
> was installed in. Under Linux, the default is the user's home directory.
> 
> Examples:
> 
> Windows XP: Creates or overwrites 'Filename' in Opera directory.
> 
> telnet://-fFileName
> 
> Under Linux: Creates or overwrites 'Filename' in user's home directory.
> 
> telnet://-nFilename
> 
> Under some previous versions of Opera, it was possible to create a file
> anywhere on the filesystem, by hex encoding an absolute path in the
> filename portion of the URI.
> 
> III. ANALYSIS
> 
> In Windows, depending on the privileges, it may be possible to make
> Opera unavailable by overwriting files. Under Linux it is possible to
> overwrite files in the current user's home directory (e.g. .bashrc,
> mbox)
> 
> Some versions or configurations of Windows may not be vulnerable, due to
> the absence of the '-f' command line switch.
> 
> IV. DETECTION
> 
> Opera 7.23 has been confirmed vulnerable, as have a variety of earlier
> versions on multiple platforms. It is suspected that all earlier
> versions are also vulnerable.
> 
> V. WORKAROUNDS
> 
> Disable the telnet URI handler from within Opera.
> 
> Click on the 'File' menu, then the 'Preferences...' item choose
> 'Programs and paths' from the view on the left. Select on 'telnet' from
> the Protocols box and press the delete key. Do the same with the tn3270
> handler.
> 
> VI. VENDOR RESPONSE
> 
> The vulnerability has been addressed in Opera 7.50 (Windows, Mac, Linux)
> 
> Windows version downloadable from
> http://www.opera.com/download/index.dml?opsys=Windows&platform=Windows&l
> ng=en&ver=7.50
> 
> Mac version downloadable from
> http://www.opera.com/download/index.dml?step=3&opsys=MacOS&lng=en&platfo
> rm=MacOS
> 
> Linux i386 version downloadable from
> http://www.opera.com/download/index.dml?step=3&opsys=Linux%20i386&lng=en
> &platform=Linux%20i386
> 
> VII. CVE INFORMATION
> 
> A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
> been assigned yet.
> 
> VIII. DISCLOSURE TIMELINE
> 
> April 2, 2003      Exploit acquired by iDEFENSE
> April 7, 2004      Initial vendor notification
> April 7, 2004      iDEFENSE clients notified
> April 14, 2004     Initial vendor response
> May 12, 2004       Coordinated public disclosure
> 
> IX. CREDIT
> 
> Karol Wiesek and Greg MacManus are credited with this discovery.
> 
> Get paid for vulnerability research
> http://www.idefense.com/poi/teams/vcp.jsp
> 
> X. LEGAL NOTICES
> 
> Copyright (c) 2004 iDEFENSE, Inc.
> 
> Permission is granted for the redistribution of this alert
> electronically. It may not be edited in any way without the express
> written consent of iDEFENSE. If you wish to reprint the whole or any
> part of this alert in any other medium other than electronically, please
> email customerservice@...fense.com for permission.
> 
> Disclaimer: The information in the advisory is believed to be accurate
> at the time of publishing based on currently available information. Use
> of the information constitutes acceptance for use in an AS IS condition.
> There are no warranties with regard to this information. Neither the
> author nor the publisher accepts any liability for any direct, indirect,
> or consequential loss or damage arising from use of, or reliance on,
> this information.
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>