Opera Web Browser Location Replace URI Obfuscation Weakness

Bugtraq ID:	10810
Class:	Race Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 27 2004 12:00AM
Updated:	Jul 27 2004 12:00AM
Credit:	Discovery of this issue is credited to "bitlance winter" <[email protected]>.
Vulnerable:	Opera Software Opera Web Browser 7.53
Not Vulnerable:	Opera Software Opera Web Browser 7.54

Opera Web Browser Location Replace URI Obfuscation Weakness

Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information. This issue is due to a race condition error.

This issue may be leveraged by an attacker to display false information in the address bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to be derived from a trusted location. This may facilitate phishing attacks; attempted theft of user information for the purpose of identity theft.

Although this issue and those outlined in BIDs 10337, 10452, and 10679 have a similar affect, they are not related.

Opera Web Browser Location Replace URI Obfuscation Weakness

No exploit is required to leverage this issue. The following proof of concept has been provided:

• /data/vulnerabilities/exploits/operaLocationURLObfuscationWeaknessPOC2.html.txt

Opera Web Browser Location Replace URI Obfuscation Weakness

Solution:
It is reported that Opera 7.54 is not vulnerable to this issue.


Opera Software Opera Web Browser 7.53

• Opera Software Opera 7.54
  http://www.opera.com/download/

Opera Web Browser Location Replace URI Obfuscation Weakness

References:

• Opera 7.54 for Windows Changelog (Opera Software)
  
• Opera Web Browser Home Page (Opera Software)