[News Bot]

Security vendors sending out misleading information, claims Secunia

Confusion about the severity of a newly reported Opera flaw could be harming efforts to mitigate the threat, according to experts.

Secunia claimed in a blog post that security companies are sending out mixed messages about the vulnerability, including inaccurate information on its effects and causes.

The security firm said that it had spent time properly analysing the flaw's impact, and had concluded that it is far less severe than users may have been led to believe.

"Before issuing a Secunia advisory, a security specialist was tasked with thoroughly analysing the vulnerability report, the cause of the crash and its potential impact," wrote Carsten Eiram, chief security specialist at Secunia.

Eiram explained that the vulnerability is not caused by an integer overflow error, as other security companies have reported.

"Instead, in certain cases when a 64-bit 'Content-Length' value is interpreted as negative, the higher 32-bit value is ignored and the lower 32-bit value is used to copy data," he said.

"It is therefore possible to manipulate the size value in a manner to successfully corrupt memory and occasionally cause conditions where it is possible to gain control of the execution flow."

Eiram went on to assert that at least one of Secunia's competitors misled users.

"At least one other site did, as usual, abuse the opportunity to hype the vulnerability and refer to it as a zero-day, which is misleading as no working exploit has been published nor is the vulnerability being actively exploited," he wrote.

"Instead, it was an uncoordinated, commonly termed 'irresponsible', disclosure as the vulnerability report was published without the reporter first informing the vendor."

Secunia has worked with Opera in analysing the issue, and the browser maker has promised to issue a security advisory and a fix as soon as possible.


View: Original Article