PornoSecurity

Opera 9.62 URL Handler Heap Overflow

Posted on 2008-11-18 11:54:10 in PornoSecurity

Hi there, ladies and gents. it's now the Opera turn. :)

As you can see in the comments section send9 contacted me and gave me some details on a reproducible crash he founds in the url:// handler of the Opera browser. I was very busy at the time and so two weeks passed before I found some time to play with the stuff he sends to me.

It is an heap overflow and I  managed to achieve code execution by overwriting a function pointer and using Heap Spraying to put shellcode in a known location. I used a slighty modified version of the heap spraying code you usually find in exploits, this one will not be detected by your antivirus :). It wasn't hard at all to write this sploit because Opera makes massive use of function pointers and the chunk overflowed is just in the middle of some useful structures. Withouth that it would be a pain to exploit this kind of vuln.

Then we, send9 and me, coordinate the disclosure of the vulnerability and the release of the exploit.

As usual you can find the exploit here, and a video demonstration here.