Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Opera: Multiple vulnerabilities
Informations
Name GLSA-200811-01 First vendor Publication 2008-11-03
Vendor Gentoo Last vendor Modification 2008-11-03
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities have been discovered in Opera, allowing for the execution of arbitrary code.

Background

Opera is a fast web browser that is available free of charge.

Description

Multiple vulnerabilities have been discovered in Opera:

* Opera does not restrict the ability of a framed web page to change the address associated with a different frame (CVE-2008-4195).

* Chris Weber (Casaba Security) discovered a Cross-site scripting vulnerability (CVE-2008-4196).

* Michael A. Puls II discovered that Opera can produce argument strings that contain uninitialized memory, when processing custom shortcut and menu commands (CVE-2008-4197).

* Lars Kleinschmidt discovered that Opera, when rendering an HTTP page that has loaded an HTTPS page into a frame, displays a padlock icon and offers a security information dialog reporting a secure connection (CVE-2008-4198).

* Opera does not prevent use of links from web pages to feed source files on the local disk (CVE-2008-4199).

* Opera does not ensure that the address field of a news feed represents the feed's actual URL (CVE-2008-4200).

* Opera does not check the CRL override upon encountering a certificate that lacks a CRL (CVE-2008-4292).

* Chris (Matasano Security) reported that Opera may crash if it is redirected by a malicious page to a specially crafted address (CVE-2008-4694).

* Nate McFeters reported that Opera runs Java applets in the context of the local machine, if that applet has been cached and a page can predict the cache path for that applet and load it from the cache (CVE-2008-4695).

* Roberto Suggi Liverani (Security-Assessment.com) reported that Opera's History Search results does not escape certain constructs correctly, allowing for the injection of scripts into the page (CVE-2008-4696).

* David Bloom reported that Opera's Fast Forward feature incorrectly executes scripts from a page held in a frame in the outermost page instead of the page the JavaScript URL was located (CVE-2008-4697).

* David Bloom reported that Opera does not block some scripts when previewing a news feed (CVE-2008-4698).

* Opera does not correctly sanitize content when certain parameters are passed to Opera's History Search, allowing scripts to be injected into the History Search results page (CVE-2008-4794).

* Opera's links panel incorrectly causes scripts from a page held in a frame to be executed in the outermost page instead of the page where the URL was located (CVE-2008-4795).

Impact

These vulnerabilties allow remote attackers to execute arbitrary code, to run scripts injected into Opera's History Search with elevated privileges, to inject arbitrary web script or HTML into web pages, to manipulate the address bar, to change Opera's preferences, to determine the validity of local filenames, to read cache files, browsing history, and subscribed feeds or to conduct other attacks.

Workaround

There is no known workaround at this time.

Resolution

All Opera users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/opera-9.62"

References

[ 1 ] CVE-2008-4195 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4195
[ 2 ] CVE-2008-4196 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4196
[ 3 ] CVE-2008-4197 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4197
[ 4 ] CVE-2008-4198 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4198
[ 5 ] CVE-2008-4199 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4199
[ 6 ] CVE-2008-4200 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4200
[ 7 ] CVE-2008-4292 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4292
[ 8 ] CVE-2008-4694 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4694
[ 9 ] CVE-2008-4695 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4695
[ 10 ] CVE-2008-4696 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4696
[ 11 ] CVE-2008-4697 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4697
[ 12 ] CVE-2008-4698 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4698
[ 13 ] CVE-2008-4794 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4794
[ 14 ] CVE-2008-4795 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4795

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200811-01.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200811-01.xml

CAPEC : Common Attack Pattern Enumeration & Classification

Id Name
CAPEC-26 Leveraging Race Conditions
CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
CAPEC-172 Time and State Attacks

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
17 % CWE-264 Permissions, Privileges, and Access Controls
17 % CWE-200 Information Exposure
17 % CWE-20 Improper Input Validation
8 % CWE-255 Credentials Management
8 % CWE-59 Improper Link Resolution Before File Access ('Link Following')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 101
Application 117

OpenVAS Exploits

Date Description
2008-11-19 Name : FreeBSD Ports: opera, linux-opera
File : nvt/freebsd_opera14.nasl
2008-11-19 Name : Gentoo Security Advisory GLSA 200811-01 (opera)
File : nvt/glsa_200811_01.nasl
2008-11-01 Name : FreeBSD Ports: opera, linux-opera
File : nvt/freebsd_opera12.nasl
2008-11-01 Name : FreeBSD Ports: opera, linux-opera
File : nvt/freebsd_opera13.nasl
2008-10-31 Name : Opera Web Browser Command Execution and XSS Vulnerabilities (Linux)
File : nvt/gb_opera_cmd_exec_n_xss_vuln_lin.nasl
2008-10-31 Name : Opera Web Browser Command Execution and XSS Vulnerabilities (Win)
File : nvt/gb_opera_cmd_exec_n_xss_vuln_win.nasl
2008-10-30 Name : Opera Remote Code Execution and Information Disclosure Vulnerabilities (Linux)
File : nvt/gb_opera_info_disc_n_code_exec_lin.nasl
2008-10-30 Name : Opera Remote Code Execution and Information Disclosure Vulnerabilities (Win)
File : nvt/gb_opera_info_disc_n_code_exec_win.nasl
2008-10-30 Name : Opera Web Browser Multiple XSS Vulnerability (Linux)
File : nvt/gb_opera_mult_vuln_oct08_lin.nasl
2008-10-30 Name : Opera Web Browser Multiple XSS Vulnerability (Win)
File : nvt/gb_opera_mult_vuln_oct08_win.nasl
2008-09-04 Name : FreeBSD Ports: opera, linux-opera
File : nvt/freebsd_opera11.nasl
2008-08-22 Name : Opera Web Browser Multiple Security Vulnerabilities Aug-08 (Linux)
File : nvt/secpod_opera_mult_vuln_aug08_lin_900039.nasl
2008-08-22 Name : Opera Web Browser Multiple Security Vulnerabilities Aug-08 (Win)
File : nvt/secpod_opera_mult_vuln_aug08_win_900038.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
49741 Opera News Feed Preview Arbitrary Feed Creation / Access
49740 Opera Fast Forward Feature Framed Content XSS
49739 Opera Opera.dll History Search Database anchor Identifier XSS
49473 Opera Links Panel Outermost Page Frame Handling XSS
49472 Opera History Search Results Page Arbitrary Remote Command Execution

A command execution flaw exists in Opera. The History Search Results page fails to validate contents resulting in command execution. With a specially crafted website, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.
49094 Opera Java Applet Cache Path Prediction Information Disclosure
49093 Opera Crafted Address Handling Arbitrary Code Execution
48719 Opera Unspecified XSS
47692 Opera Framed Content Cross-domain Content Spoofing
47691 Opera Shortcut External Application Arbitrary Command Execution
47690 Opera Frame Loaded Content Cross-domain Security Status Spoofing
47689 Opera Feed Link Local File Enumeration
47688 Opera Feed Subscription Displayed Address Spoofing
46697 Opera OCSP / CRL Unspecified Security Setting Manipulation

Snort® IPS/IDS

Date Description
2014-01-10 Opera Web Browser History Search Input validation vulnerability
RuleID : 21399 - Revision : 4 - Type : BROWSER-OTHER

Nessus® Vulnerability Scanner

Date Description
2008-11-04 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_0e30e802a9db11dd93a2000bcdf0a03b.nasl - Type : ACT_GATHER_INFO
2008-11-04 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200811-01.nasl - Type : ACT_GATHER_INFO
2008-10-31 Name : The remote host contains a web browser that is affected by several issues.
File : opera_962.nasl - Type : ACT_GATHER_INFO
2008-10-29 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_f5c4d7f79f4b11ddbab1001999392805.nasl - Type : ACT_GATHER_INFO
2008-10-21 Name : The remote host contains a web browser that is affected by several issues.
File : opera_961.nasl - Type : ACT_GATHER_INFO
2008-10-10 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_fb84d5dd952811dd9a00001999392805.nasl - Type : ACT_GATHER_INFO
2008-10-08 Name : The remote host contains a web browser that is affected by several issues.
File : opera_960.nasl - Type : ACT_GATHER_INFO
2008-08-26 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_73ec100872f011dd874b0030843d3802.nasl - Type : ACT_GATHER_INFO
2008-08-20 Name : The remote host contains a web browser that is affected by several issues.
File : opera_952.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:36:07
  • Multiple Updates