Opera SSL Certificate Spoofing Weakness

Bugtraq ID:	18692
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2006 12:00AM
Updated:	Aug 24 2006 10:59PM
Credit:	This weakness was discovered by Jakob Balle, Secunia Research.
Vulnerable:	S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 10.1 Opera Software Opera Web Browser 8.54
Not Vulnerable:	Opera Software Opera Web Browser 9

Opera SSL Certificate Spoofing Weakness

Opera is prone to security-bar spoofing. Attackers may exploit this via a malicious web page to spoof the SSL credentials of a site that the victim may trust. This weakness may be useful in phishing or other attacks that rely on content spoofing.

Opera SSL Certificate Spoofing Weakness

No exploit is required to carry out this attack.

Opera SSL Certificate Spoofing Weakness

Solution:
Opera Software has released version 9 of the Opera browser, which rectifies this issue.

Please see the vendor advisories for additional information.

Opera SSL Certificate Spoofing Weakness

References:

• Mozilla Firefox Home Page (Mozilla)
  
• Secunia Advisory SA19480 (Secunia)