| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040513151606.GA25578@symantec.bugtraq.org> From: thief at bugtraq.org (Richard Johnson) Subject: iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability Opera Telnet URI Handler File Creation/Truncation Vulnerability iDEFENSE Security Advisory 05.12.04 www.idefense.com/application/poi/display?id=104&type=vulnerabilities May 12, 2004 I. BACKGROUND Opera is a cross-platform web browser. More information is available from http://www.opera.com/ II. DESCRIPTION Exploitation of an input validation vulnerability within Opera Software ASA.'s Opera Web Browser could allow remote attackers to create or truncate arbitrary files. The problem specifically exists within the telnet URI handler. Opera does not check for '-' at the beginning of hostname passed through the handler, which lets options pass to the telnet program, allowing file creation or overwriting. Under Windows XP, when telnet.exe is executed with the '-f' option, the remainder of the argument is used as a filename for logging the connection. Under Linux, the '-n' option creates a 'tracefile' for the connection. These options create a file if it does not exist, or truncates it if it does. If a telnet: URI with the appropriate option is opened, a file will be created in the current working directory of the Opera process if the user has permission. In Windows, this defaults to the directory Opera was installed in. Under Linux, the default is the user's home directory. Examples: Windows XP: Creates or overwrites 'Filename' in Opera directory. telnet://-fFileName Under Linux: Creates or overwrites 'Filename' in user's home directory. telnet://-nFilename Under some previous versions of Opera, it was possible to create a file anywhere on the filesystem, by hex encoding an absolute path in the filename portion of the URI. III. ANALYSIS In Windows, depending on the privileges, it may be possible to make Opera unavailable by overwriting files. Under Linux it is possible to overwrite files in the current user's home directory (e.g. .bashrc, mbox) Some versions or configurations of Windows may not be vulnerable, due to the absence of the '-f' command line switch. IV. DETECTION Opera 7.23 has been confirmed vulnerable, as have a variety of earlier versions on multiple platforms. It is suspected that all earlier versions are also vulnerable. V. WORKAROUNDS Disable the telnet URI handler from within Opera. Click on the 'File' menu, then the 'Preferences...' item choose 'Programs and paths' from the view on the left. Select on 'telnet' from the Protocols box and press the delete key. Do the same with the tn3270 handler. VI. VENDOR RESPONSE The vulnerability has been addressed in Opera 7.50 (Windows, Mac, Linux) Windows version downloadable from http://www.opera.com/download/index.dml?opsys=Windows&platform=Windows&l ng=en&ver=7.50 Mac version downloadable from http://www.opera.com/download/index.dml?step=3&opsys=MacOS&lng=en&platfo rm=MacOS Linux i386 version downloadable from http://www.opera.com/download/index.dml?step=3&opsys=Linux%20i386&lng=en &platform=Linux%20i386 VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE April 2, 2003 Exploit acquired by iDEFENSE April 7, 2004 Initial vendor notification April 7, 2004 iDEFENSE clients notified April 14, 2004 Initial vendor response May 12, 2004 Coordinated public disclosure IX. CREDIT Karol Wiesek and Greg MacManus are credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp X. LEGAL NOTICES Copyright (c) 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@...fense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. -- Richard Johnson, CISSP Senior Security Researcher iDEFENSE Inc. thief@...traq.org Get paid for security stuff!!!!!! http://www.idefense.com/contributor.html and become part of our reSearch team! http://idefense.bugtraq.org/ -------------- next part -------------- Opera Telnet URI Handler File Creation/Truncation Vulnerability iDEFENSE Security Advisory 05.12.04 www.idefense.com/application/poi/display?id=104&type=vulnerabilities May 12, 2004 I. BACKGROUND Opera is a cross-platform web browser. More information is available from http://www.opera.com/ II. DESCRIPTION Exploitation of an input validation vulnerability within Opera Software ASA.'s Opera Web Browser could allow remote attackers to create or truncate arbitrary files. The problem specifically exists within the telnet URI handler. Opera does not check for '-' at the beginning of hostname passed through the handler, which lets options pass to the telnet program, allowing file creation or overwriting. Under Windows XP, when telnet.exe is executed with the '-f' option, the remainder of the argument is used as a filename for logging the connection. Under Linux, the '-n' option creates a 'tracefile' for the connection. These options create a file if it does not exist, or truncates it if it does. If a telnet: URI with the appropriate option is opened, a file will be created in the current working directory of the Opera process if the user has permission. In Windows, this defaults to the directory Opera was installed in. Under Linux, the default is the user's home directory. Examples: Windows XP: Creates or overwrites 'Filename' in Opera directory. telnet://-fFileName Under Linux: Creates or overwrites 'Filename' in user's home directory. telnet://-nFilename Under some previous versions of Opera, it was possible to create a file anywhere on the filesystem, by hex encoding an absolute path in the filename portion of the URI. III. ANALYSIS In Windows, depending on the privileges, it may be possible to make Opera unavailable by overwriting files. Under Linux it is possible to overwrite files in the current user's home directory (e.g. .bashrc, mbox) Some versions or configurations of Windows may not be vulnerable, due to the absence of the '-f' command line switch. IV. DETECTION Opera 7.23 has been confirmed vulnerable, as have a variety of earlier versions on multiple platforms. It is suspected that all earlier versions are also vulnerable. V. WORKAROUNDS Disable the telnet URI handler from within Opera. Click on the 'File' menu, then the 'Preferences...' item choose 'Programs and paths' from the view on the left. Select on 'telnet' from the Protocols box and press the delete key. Do the same with the tn3270 handler. VI. VENDOR RESPONSE The vulnerability has been addressed in Opera 7.50 (Windows, Mac, Linux) Windows version downloadable from http://www.opera.com/download/index.dml?opsys=Windows&platform=Windows&l ng=en&ver=7.50 Mac version downloadable from http://www.opera.com/download/index.dml?step=3&opsys=MacOS&lng=en&platfo rm=MacOS Linux i386 version downloadable from http://www.opera.com/download/index.dml?step=3&opsys=Linux%20i386&lng=en &platform=Linux%20i386 VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE April 2, 2003 Exploit acquired by iDEFENSE April 7, 2004 Initial vendor notification April 7, 2004 iDEFENSE clients notified April 14, 2004 Initial vendor response May 12, 2004 Coordinated public disclosure IX. CREDIT Karol Wiesek and Greg MacManus are credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp X. LEGAL NOTICES Copyright (c) 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@...fense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Powered by blists - more mailing lists