Opera Web Browser 'dtoa()' Remote Code Execution Vulnerability
BID:37078
Info
Opera Web Browser 'dtoa()' Remote Code Execution Vulnerability
| Bugtraq ID: | 37078 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-0689 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2009 12:00AM |
| Updated: | Apr 28 2014 12:51AM |
| Credit: | Maksymilian Arciemowicz |
| Vulnerable: |
S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Red Hat Enterprise Linux Long Life 5.6 server Red Hat Enterprise Linux Long Life 5.3 Server Opera Software Opera Web Browser 10.01 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Aura Session Manager 5.2 Avaya Aura Messaging 6.1 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Communication Manager 5.2 Avaya Aura Communication Manager 5.1 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 |
| Not Vulnerable: |
Opera Software Opera Web Browser 10.10 |
Discussion
Opera Web Browser 'dtoa()' Remote Code Execution Vulnerability
Opera Web Browser is prone to a remote code-execution vulnerability.
Successful exploits may allow an attacker to execute arbitrary code. Failed attacks may cause denial-of-service conditions.
NOTE: This issue is related to BID 35510 (Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability), but because of differences in the code base, it is being assigned its own record.
This issue affects Opera 10.01; other versions may also be affected.
Opera Web Browser is prone to a remote code-execution vulnerability.
Successful exploits may allow an attacker to execute arbitrary code. Failed attacks may cause denial-of-service conditions.
NOTE: This issue is related to BID 35510 (Multiple BSD Distributions 'gdtoa/misc.c' Memory Corruption Vulnerability), but because of differences in the code base, it is being assigned its own record.
This issue affects Opera 10.01; other versions may also be affected.
Exploit / POC
Opera Web Browser 'dtoa()' Remote Code Execution Vulnerability
The following proof-of-concept PHP code is available:
<script>
var a=0.<?php echo str_repeat("1",296450); ?>;
</script>
The following proof-of-concept PHP code is available:
<script>
var a=0.<?php echo str_repeat("1",296450); ?>;
</script>
Solution / Fix
Opera Web Browser 'dtoa()' Remote Code Execution Vulnerability
Solution:
The issue is fixed in Opera 10.10. Please see the references for more information.
Solution:
The issue is fixed in Opera 10.10. Please see the references for more information.
References
Opera Web Browser 'dtoa()' Remote Code Execution Vulnerability
References:
References:
- Opera 10.10 (Opera Unite) for Windows changelog (Opera Software)
- Opera Homepage (Opera Software)
- Opera 10.01 Remote Array Overrun (Arbitrary code execution) ([email protected] )
- Heap buffer overflow in string to number conversion (Opera Software)
- Opera 10.01 Remote Array Overrun (Arbitrary code execution) (SecurityReason)