Opera Malicious HTML Processing Denial of Service Vulnerability

Bugtraq ID:	18585
Class:	Boundary Condition Error
CVE:	CVE-2006-3199 CVE-2006-3945
Remote:	Yes
Local:	No
Published:	Jun 22 2006 12:00AM
Updated:	Apr 30 2007 11:10PM
Credit:	Discovered by N9, bigb0u, cybergoth, iglOo, mircia, Povilas
Vulnerable:	Opera Software Opera Web Browser 9
Not Vulnerable:	Opera Software Opera Web Browser 9.01

Opera Malicious HTML Processing Denial of Service Vulnerability

Opera Web Browser is prone to a denial-of-service condition when parsing certain malicious HTML content. Successful exploits will cause the browser to fail or hang.

Opera 9 is prone to this issue; the Opera 8.x product line is not affected.

Opera Malicious HTML Processing Denial of Service Vulnerability

The following proofs of concept are available:

• /data/vulnerabilities/exploits/Opera9_href_tag_DoS.txt
• /data/vulnerabilities/exploits/Mobb26_poc.txt

Opera Malicious HTML Processing Denial of Service Vulnerability

Solution:
The vendor released version 9.01 to address this issue. Please see the references for more information.

Opera Malicious HTML Processing Denial of Service Vulnerability

References:

• Advisory: A very large href attribute value in HTML can crash Opera (Opera)
  
• MoBB #26: Opera CSS Background (hdm)
  
• Opera 9 DoS by Critical Security, Advisory #009 (Critical Security)
  
• Vendor Website (Opera Software)