Opera 9.50 beta / 9.24 Remote DoS
Remote DoS
gynvael.coldwind & Simey

Short description

Opera is vulnerable to a remote DoS attack, using spacially crafted BMP files, that causes the browser to freeze for a short amount of time (around 4 minutes on fast computer). An attacker could create a web page that contains multiple BMP files displayed by an <img> tag. This would freeze the browser for N*4 minutes, where N is the number of images (so 100 images, the browser freezez for almost 7 hours). When frozen, the browser consumes 100% CPU power.

Verbose description

BMP file format allows Run Length Encoding in case of 4 and 8 bit bitmaps. The RLE used in BMP format has additional features like skipping the decompression write pointer to end of the line (bytes 00 00), skiping to the end of bitmap (00 01), and moving the write pointer to another line and column (00 02 XX YY).

Opera has an ultra slow implementation of the 00 02 XX YY feature. Normalny an decompression algorithm adds XX and YY * width to the write pointer, but Opera has implemented a much slower way, with additional check etc. The implementation performs XX + YY * width incrementations (each with it's own checks and other calculations).

An attacker could use this fact to create a BMP file with maximum possible width (in Opera this would be around 32000 pixels), and the file's data should be filled with 00 02 FF FF opcodes (see DoS_PoC/DoS_BMP_Generator/test10.cpp for a sample generator).

One malformed bitmap freezes the browser for some time. The time depends on CPU speed. A simple benchmark tests have been performed:

Intel Core 2 Quad 2.4 GhZ over 4 minutes
Intel Celeron M 1.6 GhZ over 20 minutes

Through this time the browser is frozen, does not react to user commands, and does not redraw it's content.

Additionally, the attacker could create a web page that contains multiple images (<img> tag) to freeze the browser for N*OneFreezeTime (where N is the number of images). See DoS_PoC/RunMe.html for a simple example (10 bitmaps used). Please note that due to Opera's bitmap caching, each bitmap should be named differently (for example test1.bmp, test2.bmp, and so on).

Vendor Status

Vendor has been informed, but has not replied.
UPDATE: Vendor has fixed this issue in stable version 9.25

Proof of Concept

(This DoS'es the Opera, no warning is provided ;>)


This document and all the information it contains is provided "as is", without any warranty. The author is not responsible for the misuse of the information provided in this advisory. The advisory is provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact.