Opera Web Browser Address Bar URI Spoofing Vulnerability

Bugtraq ID:	24917
Class:	Design Error
CVE:	CVE-2007-3819
Remote:	Yes
Local:	No
Published:	Jul 16 2007 12:00AM
Updated:	Aug 28 2007 11:02PM
Credit:	Robert Swiecki is credited with the discovery of this issue.
Vulnerable:	SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 9 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Enterprise Server 10.SP1 S.u.S.E. Linux Enterprise Server 10 + Linux kernel 2.6.5 S.u.S.E. Linux Desktop 10 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc Opera Software Opera Web Browser 9.21 Opera Software Opera Web Browser 9.20 beta 1 Opera Software Opera Web Browser 9.20 Opera Software Opera Web Browser 9.10 Opera Software Opera Web Browser 9.02 Opera Software Opera Web Browser 9.01 Opera Software Opera Web Browser 9 Gentoo Linux
Not Vulnerable:	Opera Software Opera Web Browser 9.22

Opera Web Browser Address Bar URI Spoofing Vulnerability

Opera Web Browser is affected by a URI-spoofing vulnerability because it fails to adequately handle user-supplied data.

An attacker may leverage this issue by padding the URI and inserting arbitrary content to spoof the source URI of a file presented to an unsuspecting user. This may lead to a false sense of trust as the victim may be presented with a source URI of a trusted site while interacting with the attacker's malicious site.

Opera 9.21 is vulnerable; other versions may also be affected.

NOTE: KDE's Konqueror browser is also affected by this issue. Please see BID 24912 for more information.

Opera Web Browser Address Bar URI Spoofing Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.

The following example exploit is available:

http://alt.swiecki.net/oper1.html

Opera Web Browser Address Bar URI Spoofing Vulnerability

Solution:
The vendor has addressed this issue in Opera 9.22.

Please see the referenced advisories for more information.

Opera Web Browser Address Bar URI Spoofing Vulnerability

References:

• Opera Home Page (Opera Software)
  
• Konqueror: URL address bar spoofing vulnerabilities ([email protected])
  
• Opera/Konqueror: data: URL scheme address bar spoofing (Robert Swiecki)