Opera Browser Skin File Handlig Vulnerabilities

Secunia Advisory: SA10277
Release Date: 2003-11-22


Critical: Highly critical
Impact: System access

Where: From remote



Software: Opera 7.x




Description:
Two vulnerabilities have been identified in the Opera browser, which potentially can be exploited by malicious people to compromise a user's system.

1) A boundary error in the zip processing when handling skin files can be exploited to cause a buffer overflow. This may allow execution of arbitrary code on a user's system, if the user is tricked into visiting a malicious website.

This issue affects both Linux and Windows systems.

2) An input validation error when handling skin files can be exploited to place a malicious file in an arbitrary directory on a user's system. This can be done via a directory traversal attack where the URL encoded representation of backslashes is used ("%5C").

Example:
http://[malicious_server]/..%5c..%5c..%5c..%5cskin.zip

Successful exploitation requires that the user is tricked into visiting a malicious website. Only Windows platforms are affected by this issue.

Both vulnerabilities affect version 7.22 and prior.


Solution:
Update to version 7.23.
http://www.opera.com/download/

http://www.secunia.com/advisories/10277/