Opera Bugs Permit Code Execution and Cross-Domain Scripting Attacks
|
|
SecurityTracker Alert ID: 1019131 |
|
SecurityTracker URL: http://securitytracker.com/id/1019131
|
|
CVE Reference:
CVE-2007-6520, CVE-2007-6521, CVE-2007-6522, CVE-2007-6524
(Links to External Site)
|
Updated: Jan 29 2008
|
Original Entry Date: Dec 19 2007
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 9.24 and prior versions
|
Description:
Several vulnerabilities were reported in Opera. A user can cause arbitrary code to be executed on the target user's system. A remote user can conduct cross-domain scripting attacks.
A user can supply a specially crafted TLS certificate to execute arbitrary code on the target user's system. Alexander Klink of Cynops GmbH reported this vulnerability.
A remote user can exploit plug-ins and rich text editing to cause arbitrary scripting code to be executed in arbitrary domains. David Bloom reported this vulnerability.
Bitmaps can be exploited to obtain random data from system memory. Gynvael Coldwind reported this vulnerability.
|
Impact:
A user can execute arbitrary code on the target user's system.
A remote user can cause arbitrary scripting code to be executed in arbitrary domains.
|
Solution:
The vendor has issued a fixed version (9.25).
The Opera advisory is available at:
http://www.opera.com/docs/changelogs/windows/925
|
Vendor URL: www.opera.com/docs/changelogs/windows/925 (Links to External Site)
|
Cause:
Access control error, Not specified
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 19 Dec 2007 17:09:49 -0500
Subject: Opera
|
http://www.opera.com/docs/changelogs/windows/925
Security
* Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date.
* Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date.
* Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory.
* Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date.
|
|
