Re: [Full-Disclosure] iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability

From: Jakob Balle (jb_at_secunia.com)
Date: 05/13/04

  • Next message: Gerhard den Hollander: "Re: [Full-Disclosure] RE: Full-Disclosure MS Exchange message lost-so lets post how"
    To: Full-Disclosure <full-disclosure@lists.netsys.com>
    Date: 13 May 2004 12:36:04 +0200
    
    

    Another minor issue has also been corrected in Opera Browser version
    7.50, allowing malicious websites to spoof the address bar.

    The solutions remains the same, therefore no need to paste our full
    advisory here. However, if you wish further details, they can be found
    at:
    http://secunia.com/secunia_research/2004-2/
    http://secunia.com/advisories/11532/

    Best regards,

    Jakob Balle, Secunia

    On Wed, 2004-05-12 at 20:54, idlabs-advisories@idefense.com wrote:
    > Opera Telnet URI Handler File Creation/Truncation Vulnerability
    >
    > iDEFENSE Security Advisory 05.12.04
    > www.idefense.com/application/poi/display?id=104&type=vulnerabilities
    > May 12, 2004
    >
    > I. BACKGROUND
    >
    > Opera is a cross-platform web browser. More information is available
    > from http://www.opera.com/
    >
    > II. DESCRIPTION
    >
    > Exploitation of an input validation vulnerability within Opera Software
    > ASA.'s Opera Web Browser could allow remote attackers to create or
    > truncate arbitrary files.
    >
    > The problem specifically exists within the telnet URI handler. Opera
    > does not check for '-' at the beginning of hostname passed through the
    > handler, which lets options pass to the telnet program, allowing file
    > creation or overwriting. Under Windows XP, when telnet.exe is executed
    > with the '-f' option, the remainder of the argument is used as a
    > filename for logging the connection. Under Linux, the '-n' option
    > creates a 'tracefile' for the connection. These options create a file if
    > it does not exist, or truncates it if it does.
    >
    > If a telnet: URI with the appropriate option is opened, a file will be
    > created in the current working directory of the Opera process if the
    > user has permission. In Windows, this defaults to the directory Opera
    > was installed in. Under Linux, the default is the user's home directory.
    >
    > Examples:
    >
    > Windows XP: Creates or overwrites 'Filename' in Opera directory.
    >
    > telnet://-fFileName
    >
    > Under Linux: Creates or overwrites 'Filename' in user's home directory.
    >
    > telnet://-nFilename
    >
    > Under some previous versions of Opera, it was possible to create a file
    > anywhere on the filesystem, by hex encoding an absolute path in the
    > filename portion of the URI.
    >
    > III. ANALYSIS
    >
    > In Windows, depending on the privileges, it may be possible to make
    > Opera unavailable by overwriting files. Under Linux it is possible to
    > overwrite files in the current user's home directory (e.g. .bashrc,
    > mbox)
    >
    > Some versions or configurations of Windows may not be vulnerable, due to
    > the absence of the '-f' command line switch.
    >
    > IV. DETECTION
    >
    > Opera 7.23 has been confirmed vulnerable, as have a variety of earlier
    > versions on multiple platforms. It is suspected that all earlier
    > versions are also vulnerable.
    >
    > V. WORKAROUNDS
    >
    > Disable the telnet URI handler from within Opera.
    >
    > Click on the 'File' menu, then the 'Preferences...' item choose
    > 'Programs and paths' from the view on the left. Select on 'telnet' from
    > the Protocols box and press the delete key. Do the same with the tn3270
    > handler.
    >
    > VI. VENDOR RESPONSE
    >
    > The vulnerability has been addressed in Opera 7.50 (Windows, Mac, Linux)
    >
    > Windows version downloadable from
    > http://www.opera.com/download/index.dml?opsys=Windows&platform=Windows&l
    > ng=en&ver=7.50
    >
    > Mac version downloadable from
    > http://www.opera.com/download/index.dml?step=3&opsys=MacOS&lng=en&platfo
    > rm=MacOS
    >
    > Linux i386 version downloadable from
    > http://www.opera.com/download/index.dml?step=3&opsys=Linux%20i386&lng=en
    > &platform=Linux%20i386
    >
    > VII. CVE INFORMATION
    >
    > A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
    > been assigned yet.
    >
    > VIII. DISCLOSURE TIMELINE
    >
    > April 2, 2003 Exploit acquired by iDEFENSE
    > April 7, 2004 Initial vendor notification
    > April 7, 2004 iDEFENSE clients notified
    > April 14, 2004 Initial vendor response
    > May 12, 2004 Coordinated public disclosure
    >
    > IX. CREDIT
    >
    > Karol Wiesek and Greg MacManus are credited with this discovery.
    >
    > Get paid for vulnerability research
    > http://www.idefense.com/poi/teams/vcp.jsp
    >
    > X. LEGAL NOTICES
    >
    > Copyright (c) 2004 iDEFENSE, Inc.
    >
    > Permission is granted for the redistribution of this alert
    > electronically. It may not be edited in any way without the express
    > written consent of iDEFENSE. If you wish to reprint the whole or any
    > part of this alert in any other medium other than electronically, please
    > email customerservice@idefense.com for permission.
    >
    > Disclaimer: The information in the advisory is believed to be accurate
    > at the time of publishing based on currently available information. Use
    > of the information constitutes acceptance for use in an AS IS condition.
    > There are no warranties with regard to this information. Neither the
    > author nor the publisher accepts any liability for any direct, indirect,
    > or consequential loss or damage arising from use of, or reliance on,
    > this information.
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Gerhard den Hollander: "Re: [Full-Disclosure] RE: Full-Disclosure MS Exchange message lost-so lets post how"

    Relevant Pages

    • SecurityFocus Microsoft Newsletter #124
      ... Bladeenc Signed Integer Memory Corruption Vulnerability ... Opera JavaScript Console Attribute Injection Vulnerability ... Microsoft Windows 2000 NetBIOS Continuation Packets Kernel... ...
      (Focus-Microsoft)
    • Re: Closure of a previous question and new questions on system security apps...
      ... and if you're measuring your security applications by sheer ... I had considered Opera but when I tried their windows edition a year ... Windows software looses something in the translation. ... "standard" on Linux boxen is ClamAV. ...
      (Ubuntu)
    • Re: Help! Proliferation of applications!
      ... > The ONE thing that I find difficult about Linux is the sheer proliferation ... > of applications. ... recently - purely because I use Thunderbird if I'm stuck on a Windows box, ... if they had an Opera bookmarks import, and if they hadn't just ripped off ...
      (comp.os.linux.misc)
    • [NEWS] Opera Telnet URI Handler File Creation/Truncation Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Exploitation of an input validation vulnerability within Opera Software ... Under Windows XP, when telnet.exe is executed with the '-f' ... The vulnerability has been addressed in Opera 7.50. ...
      (Securiteam)
    • [EXPL] Opera JPEG Processing Heap Corruption Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Opera JPEG Processing Heap Corruption Vulnerabilities ... - ntdll.RtlAllocateHeapDHT vulnerability ... 74E5D7E0 mov edi, eax ...
      (Securiteam)