Opera < 9.62 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 4729

Synopsis

The remote host contains a web browser that is affected by several issues.

Description

The version of Opera installed on the remote host is earlier than 9.62 and thus reportedly affected by several issues :

- Opera fails to sanitize certain parameters passed to the 'History Search' (906).
- The browser's same-origin policy may be violated because scripts running in the 'Links Panel' always run in the outermost frame of the page (907).

Successful exploitation would result in the attacker being able to execute arbitrary script code in the unsuspecting user's browser and may also lead to cookie-based credential theft, browser setting modifications and other attacks. These attacks require that the attacker is able to trick a user into browsing to a malicious URI with the affected application.

Solution

Upgrade to version 9.62 or higher.

See Also

http://aviv.raffon.net/2008/10/30/AdifferentOpera.aspx

http://www.opera.com/support/search/view/906

http://www.opera.com/support/search/view/907

http://www.opera.com/docs/changelogs/windows/962

http://www.securityfocus.com/bid/31991

Plugin Details

Severity: Medium

ID: 4729

File Name: 4729.prm

Family: Web Clients

Published: 2008/10/30

Modified: 2016/01/19

Dependencies: 1735, 8314

Nessus ID: 34680

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5.6

Temporal Score: 5.2

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:opera:opera_browser

Reference Information

CVE: CVE-2008-4794, CVE-2008-4795

BID: 31991