Opera Web Browser Address Bar Spoofing Weakness

Bugtraq ID:	10337
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 13 2004 12:00AM
Updated:	May 13 2004 12:00AM
Credit:	Discovery is credited to Jakob Balle.
Vulnerable:	Opera Software Opera Web Browser 7.23
Not Vulnerable:	Opera Software Opera Web Browser 7.50

Opera Web Browser Address Bar Spoofing Weakness

Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information.

This is reportedly possible through malicious use of the JavaScript "unOnload" event handler when the browser is redirected to another page.

This issue could be exploited to spoof the domain of a malicious web page, potentially causing the victim user to trust the spoofed domain.

The vulnerability reportedly affects Opera 7.23 releases on Windows and Linux platforms. Earlier versions may also be affected.

Opera Web Browser Address Bar Spoofing Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Opera Web Browser Address Bar Spoofing Weakness

Solution:
This issue has been addressed in Opera 7.50.


Opera Software Opera Web Browser 7.23

• Opera Software Opera 7.50
  http://www.opera.com/download/

Opera Web Browser Address Bar Spoofing Weakness

References:

• Opera Browser Address Bar Spoofing (Secunia)
  
• Opera Web Browser Home Page (Opera Software)