Opera < 9.62 Multiple Vulnerabilities

This script is Copyright (C) 2008-2016 Tenable Network Security, Inc.


Synopsis :

The remote host contains a web browser that is affected by several
issues.

Description :

The version of Opera installed on the remote host is earlier than 9.62
and thus reportedly affected by several issues :

- Opera fails to sanitize certain parameters passed to the
'History Search' (906).

- The browser's same-origin policy may be violated because
scripts running in the 'Links Panel' always run in the
outermost frame of the page (907).

Successful exploitation would result in the attacker being able to
execute arbitrary script code in the unsuspecting user's browser and
may also lead to cookie-based credential theft, browser setting
modifications, and other attacks.

These attacks require that the attacker be able to trick a user into
browsing to a malicious URI with the affected application.

See also :

http://aviv.raffon.net/2008/10/30/AdifferentOpera.aspx
http://www.opera.com/support/search/view/906/
http://www.opera.com/support/search/view/907/
http://www.opera.com/docs/changelogs/windows/962/

Solution :

Upgrade to Opera 9.62 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 34680 ()

Bugtraq ID: 31991

CVE ID: CVE-2008-4794
CVE-2008-4795

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now