Opera Web Browser Cross-Domain Frame Loading Vulnerability
BID:10763
Info
Opera Web Browser Cross-Domain Frame Loading Vulnerability
| Bugtraq ID: | 10763 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 20 2004 12:00AM |
| Updated: | Jul 20 2004 12:00AM |
| Credit: | Mark, http-equiv, and Gary McKay are credited with conducting research for this issue. |
| Vulnerable: |
Opera Software Opera Web Browser 7.51 Opera Software Opera Web Browser 7.50 |
| Not Vulnerable: |
Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52 |
Discussion
Opera Web Browser Cross-Domain Frame Loading Vulnerability
Opera Web Browser is reported prone to a cross-domain frame loading vulnerability. It is reported that if the name of a frame rendered in a target site is known, then an attacker may potentially render arbitrary HTML in the frame of the target site.
Opera Web Browser versions 7.51 and prior are reported to be affected by this issue.
This issue was originally reported in Microsoft Internet Explorer in BID 10627 (Microsoft Internet Explorer Cross-Domain Frame Loading Vulnerability), however, further information has shown that Opera is affected by the same vulnerability.
Opera Web Browser is reported prone to a cross-domain frame loading vulnerability. It is reported that if the name of a frame rendered in a target site is known, then an attacker may potentially render arbitrary HTML in the frame of the target site.
Opera Web Browser versions 7.51 and prior are reported to be affected by this issue.
This issue was originally reported in Microsoft Internet Explorer in BID 10627 (Microsoft Internet Explorer Cross-Domain Frame Loading Vulnerability), however, further information has shown that Opera is affected by the same vulnerability.
Exploit / POC
Opera Web Browser Cross-Domain Frame Loading Vulnerability
Exploits have been developed for Microsoft Internet Explorer. These exploits may be modified and used for Opera as well.
Exploits have been developed for Microsoft Internet Explorer. These exploits may be modified and used for Opera as well.
Solution / Fix
Opera Web Browser Cross-Domain Frame Loading Vulnerability
Solution:
Opera version 7.52 and 7.53 are not vulnerable to this issue.
Gentoo has released an advisory (GLSA 200407-15) to address this and other issues in Opera. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade their computers:
emerge sync
emerge -pv ">=net-www/opera-7.53"
emerge ">=net-www/opera-7.53"
Gentoo has released a second advisory GLSA 200408-05 dealing with this issue. All Opera users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-www/opera-7.54"
# emerge ">=net-www/opera-7.54"
Please see the referenced Gentoo advisory for more information.
Opera Software Opera Web Browser 7.50
Opera Software Opera Web Browser 7.51
Solution:
Opera version 7.52 and 7.53 are not vulnerable to this issue.
Gentoo has released an advisory (GLSA 200407-15) to address this and other issues in Opera. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade their computers:
emerge sync
emerge -pv ">=net-www/opera-7.53"
emerge ">=net-www/opera-7.53"
Gentoo has released a second advisory GLSA 200408-05 dealing with this issue. All Opera users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-www/opera-7.54"
# emerge ">=net-www/opera-7.54"
Please see the referenced Gentoo advisory for more information.
Opera Software Opera Web Browser 7.50
-
Opera Software Opera 7.53
http://www.opera.com/download/
Opera Software Opera Web Browser 7.51
-
Opera Software Opera 7.53
http://www.opera.com/download/
References
Opera Web Browser Cross-Domain Frame Loading Vulnerability
References:
References:
- Opera 7.52 change log (Opera Software)