[NT] Opera Software Opera Web Browser Transfer Item Pop-up Menu Stack Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Opera Software Opera Web Browser Transfer Item Pop-up Menu Stack Overflow
Vulnerability
------------------------------------------------------------------------

SUMMARY

<http://www.opera.com/> Opera is "a cross-platform web browser". Remote
exploitation of a stack-based buffer overflow in Opera Software ASA's
Opera Web browser could allow an attacker to execute arbitrary code on the
affected host.

DETAILS

Vulnerable Systems:
* Opera version 9.2 for Windows.
* Previous versions may also be affected.

Opera 9.2 supports BitTorrent downloads. If a server sends the browser a
specially crafted BitTorrent header, it can lead to a buffer overflow. The
buffer overflow is triggered when the user right clicks on the item in the
download pane.

Exploitation of this vulnerability allows an attacker to execute arbitrary
code on the affected host.

The attacker must convince the vulnerable user into clicking a link to a
BitTorrent file.

Vendor Status:
Version 9.21 of Opera has been released to address this issue.
More information can be found at the following URL:
<http://www.opera.com/support/search/view/860/>

http://www.opera.com/support/search/view/860/

Disclosure Timeline:
* 05/08/2007 - Initial vendor notification
* 05/08/2007 - Initial vendor response
* 05/23/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by iDefense.
The original article can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=535>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=535

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.