Opera 7.54 and earlier allows remote attackers to spoof file types in the download dialog via dots and non-breaking spaces (ASCII character code 160) in the (1) Content-Disposition or (2) Content-Type headers.

The remote host is affected by the vulnerability described in GLSA-200502-17 (Opera: Multiple vulnerabilities)

    Opera contains several vulnerabilities:
    fails to properly validate Content-Type and filename.
    fails to properly validate date: URIs.
    uses kfmclient exec as the Default Application to handle downloaded     files when integrated with KDE.
    fails to properly control frames.
    uses Sun Java packages insecurely.
    searches an insecure path for plugins.
  Impact :

    An attacker could exploit these vulnerabilities to:
    execute arbitrary code.
    load a malicious frame in the context of another browser     session.
    leak information.
  Workaround :

    There is no known workaround at this time.

The remote host is using a version of Opera that is prone to a security flaw where a malicious website can spoof a filename within a download dialog box.  An attacker exploiting this flaw would need to be able to entice a local user to browse to a malicious website.  Upon visiting the website, the user would download a file with an obfuscated name. 

The version of Opera on the remote host contains a flaw that allows an attacker to determine the existence of files and directories on the remote host.

To exploit this flaw, an attacker would need to set up a rogue website and lure a user of the remote host into visiting it with Opera.

The remote host is using Opera, which is affected by a security weakness which may permit an attacker to determine the existence of a resources on the vulnerable computer.

ID	Name	Product	Family	Type	Severity
16458	GLSA-200502-17 : Opera: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
2467	Opera < 7.54u1 Download Box Spoofing	Nessus Network Monitor	Web Clients		medium
14346	Opera < 7.54 Download File Type Dialog Spoofing	Nessus	Windows	Local	medium
1782	Opera < 7.54u1 Web Browser Resource Detection Weakness	Nessus Network Monitor	Web Clients		low

Detections

Analytics

CVE-2004-1490

high

Tenable Plugins

high

medium

medium

low