|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs Security Advisories.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424
|
| |
Vulnerable Systems:
* Opera versions 9.0 and 9.01
Immune Systems:
* Opera version 8.0
A flaw exists within Opera when parsing a tag that contains a URL. A heap buffer with a constant size of 256 bytes is allocated to store the URL, and the tag's URL is copied into this buffer without sufficient bounds checking of its length. The vulnerable code would look something like this in C/C++:
char *local_url = malloc(256);
strcpy(local_url, tag_url);
This URL can be inserted into any tag, such as an iframe. The range of characters that can be used to overflow the buffer is limited.
Vendor response:
Opera has addressed this vulnerability with version 9.02 of the Opera Web Browser. More information can be found in Opera's advisory at http://www.opera.com/support/search/supsearch.dml?index=848.
CVE Information:
CVE-2006-4819
Disclosure Timeline:
09/15/2006 - Initial vendor notification
09/29/2006 - Initial vendor response
10/17/2006 - Coordinated public disclosure
|
|
|
|
|
