SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Opera Vendors:   Opera Software
Opera Telnet URL Processing Flaw Lets Remote Users Create or Overwrite Files
SecurityTracker Alert ID:  1010142
SecurityTracker URL:  http://securitytracker.com/id/1010142
CVE Reference:   CVE-2004-0473   (Links to External Site)
Updated:  May 20 2004
Original Entry Date:  May 12 2004
Impact:   Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): prior to 7.50; confirmed on 7.23
Description:   iDEFENSE reported a vulnerability in Opera in the processing of telnet URLs. A remote user can create a URL that, when loaded, will create or overwrite files on the target user's system.

It is reported that the telnet URL handler does not properly validate user-supplied telnet URLs. In particular, the software reportedly does not check for the dash character ('-') preceeding the hostname, allowing a remote user to create a URL that will pass command options to the telnet application on the target user's system. This may allow for the creation and/or overwriting of some files on the target user's system, depending on the target user's operating system and telnet configuration.

The report indicates that a remote user can supply the '-f' option followed by a filename to a target user with Windows XP to cause the specified file to be created as a logging file in the Opera installation directory, if the target user has privileges to write to that directory. A demonstration exploit URL is provided:

telnet://-fFileName

The report also indicates that a remote user can supply the '-n' option followed by a filename to a target user with Linux to cause the specified file to be created or overwritten in the target user's home directory. A demonstration exploit URL is provided:

telnet://-nFilename

In some older versions of Opera, a remote user can reportedly hex encode an absolute path for the filename to create arbitrary files on the target user's system.

The vendor was reportedly notified on April 14, 2004.

The original advisory is available at:

http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities

Impact:   A remote user can create a URL that, when loaded by the target user, will create or overwrite certain files on the target user's system with the privileges of the target user.
Solution:   The vendor has released a fixed version (7.50), available at:

http://www.opera.com/download/

Vendor URL:  www.opera.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  BeOS, Linux (Any), Apple (Legacy "classic" Mac), QNX, UNIX (FreeBSD), UNIX (Solaris - SunOS), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 27 2004 (Gentoo Issues Fix) Opera Telnet URL Processing Flaw Lets Remote Users Create or Overwrite Files
Gentoo has issued a fix.



 Source Message Contents

Subject:  iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File


Opera Telnet URI Handler File Creation/Truncation Vulnerability

iDEFENSE Security Advisory 05.12.04
www.idefense.com/application/poi/display?id=104&type=vulnerabilities
May 12, 2004

I. BACKGROUND

Opera is a cross-platform web browser. More information is available
from http://www.opera.com/

II. DESCRIPTION

Exploitation of an input validation vulnerability within Opera Software
ASA.'s Opera Web Browser could allow remote attackers to create or
truncate arbitrary files.

The problem specifically exists within the telnet URI handler. Opera
does not check for '-' at the beginning of hostname passed through the
handler, which lets options pass to the telnet program, allowing file
creation or overwriting. Under Windows XP, when telnet.exe is executed
with the '-f' option, the remainder of the argument is used as a
filename for logging the connection. Under Linux, the '-n' option
creates a 'tracefile' for the connection. These options create a file if
it does not exist, or truncates it if it does.

If a telnet: URI with the appropriate option is opened, a file will be
created in the current working directory of the Opera process if the
user has permission. In Windows, this defaults to the directory Opera
was installed in. Under Linux, the default is the user's home directory.

Examples:

Windows XP: Creates or overwrites 'Filename' in Opera directory.

telnet://-fFileName

Under Linux: Creates or overwrites 'Filename' in user's home directory.

telnet://-nFilename

Under some previous versions of Opera, it was possible to create a file
anywhere on the filesystem, by hex encoding an absolute path in the
filename portion of the URI.

III. ANALYSIS

In Windows, depending on the privileges, it may be possible to make
Opera unavailable by overwriting files. Under Linux it is possible to
overwrite files in the current user's home directory (e.g. .bashrc,
mbox)

Some versions or configurations of Windows may not be vulnerable, due to
the absence of the '-f' command line switch.

IV. DETECTION

Opera 7.23 has been confirmed vulnerable, as have a variety of earlier
versions on multiple platforms. It is suspected that all earlier
versions are also vulnerable.

V. WORKAROUNDS

Disable the telnet URI handler from within Opera.

Click on the 'File' menu, then the 'Preferences...' item choose
'Programs and paths' from the view on the left. Select on 'telnet' from
the Protocols box and press the delete key. Do the same with the tn3270
handler.

VI. VENDOR RESPONSE

The vulnerability has been addressed in Opera 7.50 (Windows, Mac, Linux)

Windows version downloadable from
http://www.opera.com/download/index.dml?opsys=Windows&platform=Windows&l
ng=en&ver=7.50

Mac version downloadable from
http://www.opera.com/download/index.dml?step=3&opsys=MacOS&lng=en&platfo
rm=MacOS

Linux i386 version downloadable from
http://www.opera.com/download/index.dml?step=3&opsys=Linux%20i386&lng=en
&platform=Linux%20i386

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

April 2, 2003      Exploit acquired by iDEFENSE
April 7, 2004      Initial vendor notification
April 7, 2004      iDEFENSE clients notified
April 14, 2004     Initial vendor response
May 12, 2004       Coordinated public disclosure

IX. CREDIT

Karol Wiesek and Greg MacManus are credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2004 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC