Re: Unchecked Buffer in Opera 7.02

[0164455001 <0164455001 () netcabo pt>]

Hello I.R.van,

Tuesday, April 8, 2003, 8:49:13 AM, you wrote:

> Opera 6.11 (Linux does not seem to be affected.

> ntentas descargar este archivo desde una página gratuita de usuario de Tripod :
> http://usuarios.lycos.es/idoru/aaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.zip

> Para acceder a este archivo, necesitas visitar la página del usuario:
> http://usuarios.lycos.es/idoru
> (serás remitido automáticamente a Lycos Tripod España en 5 segundos)

> My spanish isn't that good, but it seems I get a nice 404 page.

The page tell you to take the zip file from the main page
which is <http://usuarios.lycos.es/idoru>


> Greetings,

> Ivo van Dongen

> On Mon, 7 Apr 2003 22:39:26 -0300 (ART)
> "David F.Madrid" <conde0 () telefonica net> wrote:

> > Tested version : Opera 7.02 Build 2668
> >
> > Vendor Status : Vendor was contacted on 8-4-2003
> >
> > Description :
> >
> > Opera web browser has an unchecked buffer in his code that allow a
> > malicious website to crash it and in certain circumstances , execute code
> > with user priviliges .
> >
> > To reproduce the bug open this link
> >
> > http://usuarios.lycos.es/idoru/aaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.zip
> >
> > Opera crashes with an access violation . Instruction pointer EIP is
> > overwritten by the file name converted to unicode . That makes only
> > possible to reference certain addresses in memory to execute . To place
> > your code to execute in a valid address you have to assign it to an
> > enviroment variable .That place your code in an address that can be
> > referenced by EIP ( ~00010040 )
> >
> >
> > -- 
> >
> > Regards ,
> >
> > David F.Madrid
> > Madrid , Spain



 


-- 
Best regards,
 0164455001                      <mailto:0164455001 () netcabo pt>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html