Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted header in a torrent file, which leaves a dangling pointer to an invalid object.

The remote host is affected by the vulnerability described in GLSA-200708-17 (Opera: Multiple vulnerabilities)

    An error known as 'a virtual function call on an invalid pointer' has     been discovered in the JavaScript engine (CVE-2007-4367). Furthermore,     iDefense Labs reported that an already-freed pointer may be still used     under unspecified circumstances in the BitTorrent support     (CVE-2007-3929). At last, minor other errors have been discovered,     relative to memory read protection (Opera Advisory 861) and URI     displays (CVE-2007-3142, CVE-2007-3819).
  Impact :

    A remote attacker could trigger the BitTorrent vulnerability by     enticing a user into starting a malicious BitTorrent download, and     execute arbitrary code through unspecified vectors. Additionally, a     specially crafted JavaScript may trigger the 'virtual function'     vulnerability. The JavaScript engine can also access previously freed     but uncleaned memory. Finally, a user can be fooled with a too long     HTTP server name that does not fit the dialog box, or a URI containing     whitespaces.
  Workaround :

    There is no known workaround at this time for all these     vulnerabilities.

The version of Opera installed on the remote host reportedly can be tricked into attempting to dereference an invalid object pointer when parsing a specially crafted BitTorrent header. This could cause the application to crash or even lead to execution of arbitrary code subject to the privileges of the current user. 

Successful exploitation requires that a user on the affected host click on a link to a BitTorrent file and then remove the entry from Opera's download manager. 

In addition, it can mistakenly display the end of a 'data:' URL rather than the beginning, which can lead to spoofing of trusted sites.

Opera Software ASA reports of multiple security fixes in Opera, including an arbitrary code execute vulnerability :

Opera for Linux, FreeBSD, and Solaris has a flaw in the createPattern function that leaves old data that was in the memory before Opera allocated it in the new pattern. The pattern can be read and analyzed by JavaScript, so an attacker can get random samples of the user's memory, which may contain data.

Removing a specially crafted torrent from the download manager can crash Opera. The crash is caused by an erroneous memory access.

An attacker needs to entice the user to accept the malicious BitTorrent download, and later remove it from Opera's download manager. To inject code, additional means will have to be employed.

Users clicking a BitTorrent link and rejecting the download are not affected.

data: URLs embed data inside them, instead of linking to an external resource. Opera can mistakenly display the end of a data URL instead of the beginning. This allows an attacker to spoof the URL of a trusted site.

Opera's HTTP authentication dialog is displayed when the user enters a Web page that requires a login name and a password. To inform the user which server it was that asked for login credentials, the dialog displays the server name.

The user has to see the entire server name. A truncated name can be misleading. Opera's authentication dialog cuts off the long server names at the right hand side, adding an ellipsis (...) to indicate that it has been cut off.

The dialog has a predictable size, allowing an attacker to create a server name which will look almost like a trusted site, because the real domain name has been cut off. The three dots at the end will not be obvious to all users.

This flaw can be exploited by phishers who can set up custom sub-domains, for example by hosting their own public DNS.

The version of Opera installed on the remote host reportedly contains a buffer overflow vulnerability that can be triggered by a malicious Torrent file.  Successful exploitation requires that a user browse to a malicious URI and is enticed into opening a malformed torrent file.  Successful exploitation may allow a remote attacker to execute arbitrary code subject to the privileges of the user.

ID	Name	Product	Family	Severity
26040	GLSA-200708-17 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25755	Opera < 9.22 Multiple Vulnerabilities	Nessus	Windows	high
25748	FreeBSD : opera -- multiple vulnerabilities (12d266b6-363f-11dc-b6c9-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	high
4142	Opera < 9.22 Torrent File Overflow	Nessus Network Monitor	Web Clients	medium
800818	Opera < 9.22 Torrent File Overflow	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2007-3929

high

Tenable Plugins

high

high

high

medium

high