Critical Opera security hole upto V.7.22

[jeeza]

The following is from a post in the SecureComp newsgroup on news.securecomp.org (the title states that Opera 7.23 is available).


From NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Date: Fri, 21 Nov 2003 08:55:01 +0900
Reply-To: Windows NTBugtraq Mailing List
From: ":: Operash ::" <nesumin@SOFTHOME.NET>
Subject: [Opera 7] Arbitrary File Auto-Saved Vulnerability.
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

---------------------------------------------------------------------------------
TITLE : [Opera 7] Arbitrary File Auto-Saved Vulnerability.
-= For Whom The Remote Customizing Runs? =-
PRODUCT : Opera 7 for Windows
VERSIONS : 7.22 build 3221 (JP:build 3222)
7.21 build 3218 (JP:build 3219)
7.20 build 3144 (JP:build 3145)
7.1x
7.0x
VENDOR : Opera Software ASA (http://www.opera.com/)
SEVERITY : Critical.
An arbitrary file could be saved on Local Disk from Remote.
DISCOVERED BY : nesumin
AUTHOR : :: Operash ::
REPORTED DATE : 2003-11-20
RELEASED DATE : 2003-11-21
----------------------------------------------------------------------------------

0. PRODUCT
============

Opera for windows is a GUI based WEB Browser.
Opera Software ASA (http://www.opera.com/)


1. DESCRIPTION
================

Opera 7 has a serious Security-Hole in the auto-install function
for Skin Files and Configuration Files.
When a user goes to a malicious Web site, attackers can exploit
this Security-Hole and make an arbitrary file on arbitrary path
inside of user's Local Disk from a WEB page.

With this Security-Hole, there could be following risks;

* Infection with Virus or Trojan, etc.
* Destruction of the system.
* Leak or alteration of the local data.


2. SYSTEMS AFFECTED
=====================

7.22 build 3221 (JP:build 3222)
7.21 build 3218 (JP:build 3219)
7.20 build 3144 (JP:build 3145)
7.1x
7.0x

All of version 7.xx above has this Security-Hole.


3. EXAMINES
=============

Opera for Windows:
Opera 7.22 build 3221 (JP:build 3222)
Opera 7.21 build 3218 (JP:build 3219)
Opera 7.20 build 3144 (JP:build 3145)
Opera 7.11 build 2887
Opera 7.11 build 2880
Opera 7.10 build 2840
Opera 7.03 build 2670
Opera 7.02 build 2668
Opera 7.01 build 2651

Platform:
Windows 98SE Japanese
Windows 2000 Professional SP4 Japanese
Windows XP Professional SP1 Japanese


4. WORKAROUND
===============

Main Menu "Preferences" -> "File Types", MIME-type list;
(check-off "Hide file types opened with Opera")

application/x-opera-skin
application/x-opera-configuration-skin
application/x-opera-configuration-mouse
application/x-opera-configuration-keyboard
application/x-opera-configuration-toolbar
application/x-opera-configuration-menu

If you change the actions of all MIME types above from
"Open with Opera" to "Show download dialog" or etc,
the auto-install function will be disabled and you can avoid
this vulnerability.

If you want to re-enable the auto-install function, change the
actions of these MIME types to "Open with Opera".


5. TECHNICAL DETAILS
======================

Opera 7 has the auto-install function for Skin File, and version
7.10 or later has the same one for Configuration Files.
This auto-install function will be executed when Opera gets an
arbitrary file with MIME-types from a Remote Server;
"application/x-opera-configuration-XXXXX" or "application/x-opera
-skin".
When Opera receives a file and one of these MIME-types, whether
user accept them or not, the file will automatically be saved
with the name that was used while downloading to the directory
for Configuration Files in the User-Directory or Installed-
Directory.
But this automatically saved file's name is not sanitized enough.
Therefore, the file could be saved in any directory which can be
specified with a relative path when the file name contains the
illegal character string '..%5C'. Even though the directory is
outside of expected scope.
(This is restricted within the directory that Opera's process
can write and the existing files cannot be overwritten and deleted.)

For example, if an executable file was saved in the start-up
directory and it ran when a user reboots computer, the user would
face a risk of Virus infection or Trojan horse running inside.
Moreover, the executable file could be for destroying a computer,
deleting data or any kinds of malicious one.

In addition, this vulnerability is different from other
vulnerabilities like buffer overflow, any advanced skills
are not necessary for exploiting. So we assume this is
highly dangerous for users.


Additional Description:

Mr. S. G. Masood has reported a similar vulnerability on 12 Nov 2003
while we were researching on this vulnerability.
And it was announced that the vulnerability Mr. Masood reported has
fixed at version 7.22.
Though, what we researched has higher severity and hasn't been
fixed yet even at version 7.22 now.


6. SAMPLE CODE
================

The sample code can be found on our WEB page.

http://opera.rainyblue.org/adv/opera06-autosaved-en.php


7. TIME TABLE & VENDOR STATUS
===============================

2003-09-30 Discovered this vulnerability.
2003-11-20 Reported to vendor.
2003-11-20 Vendor said "we have already fixed it in 7.23".
2003-11-21 Released this advisory.


8. DISCLAIMER
===============

A. We cannot guarantee the accuracy of all statements in this information.
B. We do not anticipate issuing updated versions of this information
unless there is some material change in the facts.
C. And we will take no responsibility for any kinds of disadvantages by
using this information.
D. You can quote this advisory without our permission if you keep the following;
a. Do not distort this advisory's content.
b. A quoted place should be a medium on the Internet.
E. If you have any questions, please contact to us.


9. CONTACT, ETC
=================

:: Operash :: http://opera.rainyblue.org/

imagine (Operash Webmaster)
nesumin <nesumin_at_softhome.net>


Thanks to :

melorin
piso(sexy)

----

Regards
Gordon

[sleddog]

Opera 7.23 addresses this issue and was just officially released:

http://www.opera.com/download/
http://www.opera.com/windows/changelogs/723/

That's what I call excellent response from a software company.

[mjc]

Hehe......


Yep, now if most of the other software makers would be that fast we would have fewer problems.....

[jeeza]

Opera's reponse was fast, yes, but why went the problem undiscovered for versions 01 to 22 ?
It was fast and late at the same time.

[mjc]

For the very same reason I am staring at a bug in regsvr32.exe..one that has gone unnoticed in since Win98 Gold...one that under certain cases will erase the entire Software subkey from HKLM...because nobody looked for it.

What happens is when a bug in the current version, is discovered people start backtracking to see which versions are vulnerable.

[jeeza]

Obviously this is what happened, but Opera's response was fast, as they apparently remedied the bug without delay, and it was late, as the bug wasn't discovered for so long.
The question I am asking myself is, why wasn't that bug discovered for so long a time ? Could it have been discovered ? I think yes. And should it have been discovered ? Probably.

[mjc]

The regsvr32 bug looks like it may be the culprit in some unexplained system crashes in the past, and no one really investigated it until we had direct evidence that it was a problem, a certain malware dll, maybe intentionally coded this way, was coded without the normal structure that regsvr32 uses to unregister (uninstall) a dll...as a result, the removal process removes a lot more of the registry than it should (like the entire HKLM/Software key.......). On later versions of Windows, like 2k, it causes a minor "burp" but doesn't remove the entire key.

[jeeza]

Besides, there is a substantial delay between the discovery of the bug and the report made to the vendor.
2003-09-30 Discovered this vulnerability.
2003-11-20 Reported to vendor.
There was a delay of about 40 days... I think that's irresponsible, even if the bug was fixed in the meantime anyway (and how long did they delay ?).