(Vendor Issues Fix) Opera Lets Remote Users Inject Content into Open Windows
|
|
SecurityTracker Alert ID: 1012481 |
|
SecurityTracker URL: http://securitytracker.com/id/1012481
|
|
CVE Reference:
CAN-2004-1157
(Links to External Site)
|
Date: Dec 11 2004
|
Impact:
Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.54
|
Description:
A vulnerability was reported in Opera. A remote user can inject content into an open window in certain cases to spoof web site contents.
Secunia Research reported that if the target name of an open window is known, a remote user can create Javascript that, when loaded by the target user, will display arbitrary content in the opened window. A remote user can exploit this to spoof the content of potentially trusted web sites.
A demonstration exploit test is available at:
http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
The vendor was notified on November 19, 2004.
|
Impact:
A remote user can inject arbitrary content into an open window in certain cases to spoof web site contents.
|
Solution:
The vendor has issued a fixed version (7.54u1), available at:
http://www.opera.com/download/
|
Vendor URL: www.opera.com/support/search/supsearch.dml?index=782 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
BeOS, Linux (Any), MacOS, QNX, UNIX (FreeBSD), UNIX (OS X), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Sat, 11 Dec 2004 17:31:04 -0500
Subject: http://www.opera.com/support/search/supsearch.dml?index=782
|
> Advisory: Opera security advisory 2004-12-10
> Severity: Moderate/high
Opera issued a security advisory for Opera versions 7.54 and earlier. Opera has
issued a security update 7.54u1 (http://www.opera.com/download/).
The update includes several fixes:
> * Tightened origin check for frames. A side effect of this is that documents
> not passing the origin check will open in a new page.
> * Fixed issue reported by Marc Schönefeld: intrusive JavaScript or Java applet
> could exploit Sun Java vulnerability to retrieve logged-in user's username and
> install directory.
> * Fixed LiveConnect class access security issue reported by Jouko Pynnonen.
> * Fixed Secunia issue SA12981, reported by Andreas Sandblad: periods in the
> file name and non-breaking spaces in content-type header type could obscure
> the file type.
> * Fixed Secunia issue SA13253: "hi-jacking" a named browser window.
> * Improved support for the "must-revalidate" cache directive.
The vendor credits Secunia Research, Andreas Sandblad, Mark Schonefeld, and Jouko
Pynnonen with reporting these flaws.
The original advisory is available at:
http://www.opera.com/support/search/supsearch.dml?index=782
|
|
