The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Opera Software Opera Web Browser JPG Image DHT Marker Heap Corruption
Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.opera.com/> Opera is "a cross-platform web browser". Remote
exploitation of a heap overflow in Opera Software ASA's Opera Web browser
could allow an attacker to execute arbitrary code in the security context
of the current user.
DETAILS
Vulnerable Systems:
* Opera version 9.02 on both Windows and Linux.
* Previous versions may also be affected.
The vulnerability specifically exists due to Opera improperly processing a
JPEG DHT marker. The DHT marker is used to define a Huffman Table which is
used for decoding the image data. An invalid number of index bytes in the
DHT marker will trigger a heap overflow with partially user controlled
data.
Exploitation of this vulnerability would allow an attacker to execute
arbitrary code on the affected host. The attacker would first need to
construct a website containing the malicious image and trick the
vulnerable user into visiting the site. This would trigger the
vulnerability and allow the code to execute with the privileges of the
local user.
Vendor Status:
Opera Software has addressed this vulnerability in version
<http://www.opera.com/support/search/supsearch.dml?index=852> 9.10.
Disclosure Timeline:
* 11-16-06 Initial vendor notification
* 11-17-06 Initial vendor response
* 01-05-07 Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
