BID:11883

Opera Web Browser Download Dialogue Box File Name Spoofing Vulnerability

Info

Opera Web Browser Download Dialogue Box File Name Spoofing Vulnerability

Bugtraq ID:	11883
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 11 2004 12:00AM
Updated:	Dec 11 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Andreas Sandblad.
Vulnerable:	Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52 Opera Software Opera Web Browser 7.51 Opera Software Opera Web Browser 7.50 Opera Software Opera Web Browser 7.23 Opera Software Opera Web Browser 7.22 Opera Software Opera Web Browser 7.21 Opera Software Opera Web Browser 7.20 Beta 1 build 2981 Opera Software Opera Web Browser 7.20 Opera Software Opera Web Browser 7.11 j Opera Software Opera Web Browser 7.11 b Opera Software Opera Web Browser 7.11 Opera Software Opera Web Browser 7.10 Opera Software Opera Web Browser 7.0 win32 Beta 2 Opera Software Opera Web Browser 7.0 win32 Beta 1 Opera Software Opera Web Browser 7.0 win32 Opera Software Opera Web Browser 7.0 3win32 Opera Software Opera Web Browser 7.0 2win32 Opera Software Opera Web Browser 7.0 1win32 Gentoo Linux

Not Vulnerable:	Opera Software Opera Web Browser 7.54

Discussion

Opera Web Browser Download Dialogue Box File Name Spoofing Vulnerability

A download dialogue box file name spoofing vulnerability affects Opera. This issue is due to a design error that facilitates the spoofing of file names.

The problem presents itself when an unsuspecting user attempts to download a file from a malicious site. The malicious web site may respond with HTTP header data that is sufficient to trigger the issue. As a result of this attack, the requested filename and file type may be misrepresented in a file download dialog, making it possible for an attacker to make a potentially malicious file seem innocuous.

Exploit / POC

Opera Web Browser Download Dialogue Box File Name Spoofing Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Opera Web Browser Download Dialogue Box File Name Spoofing Vulnerability

Solution:
The vendor has released fixes to address this and other issues.

Gentoo has released an advisory (GLSA 200502-17) and an updated eBuild to address this and other issues in the Opera Web Browser. This update can be installed by issuing the following sequence of commands as a superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/opera-7.54-r3"

Opera Software Opera Web Browser 7.0 win32