From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Aug 20 2008 - 18:10:04 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Opera Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31549

VERIFY ADVISORY:
http://secunia.com/advisories/31549/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Spoofing, Exposure of sensitive information, DoS,
System access

WHERE:
From remote

SOFTWARE:
Opera 5.x
http://secunia.com/product/82/
Opera 6.x
http://secunia.com/product/81/
Opera 7.x
http://secunia.com/product/761/
Opera 8.x
http://secunia.com/product/4932/
Opera 9.x
http://secunia.com/product/10615/

DESCRIPTION:
Some vulnerabilities have been reported in Opera, which can be
exploited by malicious people to conduct spoofing and cross-site
scripting attacks, bypass certain security restrictions, disclose
potentially sensitive information, or potentially compromise a user's
system.

1) An unspecified error exists when Opera is executed as a protocol
handler. This can be exploited to cause a crash and potentially
execute arbitrary code.

NOTE: Reportedly, the vulnerability only affects Opera for Windows.

2) The problem is that a web page can change the address of frames
from other sites opened inside a pop-up window. This can be exploited
to load malicious content into a frame of a trusted website.

3) An unspecified error can be exploited to conduct cross-site
scripting attacks. No further information is currently available.

4) An error exists in the processing of custom shortcut and menu
commands. This can be exploited to execute applications with
potentially dangerous parameters, created from uninitialized memory.

Successful exploitation may allow execution of arbitrary code, but
requires that a user is tricked into modifying shortcuts or menu
files.

5) An error exists while reporting websites as secure for browsing.
This can be exploited to determine the reporting of an insecure
website as secure by including a frame with content from a secure
website.

6) An error exists when checking if a web page links to a local file.
This can be exploited to link to local feed source files and
potentially determine if a file is present on the local system.

7) An error exists when processing news feed subscription requests.
This can be exploited to change the address field to the address of
the malicious web page and mislead a user.

The vulnerabilities are reported in versions prior to 9.52.

SOLUTION:
Update to version 9.52.
http://www.opera.com/download/

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
3) Chris Weber of Casaba Security
4) Michael A. Puls II
5) Lars Kleinschmidt

ORIGINAL ADVISORY:
http://www.opera.com/docs/changelogs/windows/952/

http://www.opera.com/support/search/view/892/
http://www.opera.com/support/search/view/893/
http://www.opera.com/support/search/view/894/
http://www.opera.com/support/search/view/895/
http://www.opera.com/support/search/view/896/
http://www.opera.com/support/search/view/897/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]