Opera Web Browser History Search Input Validation Vulnerability
BID:31869
Info
Opera Web Browser History Search Input Validation Vulnerability
| Bugtraq ID: | 31869 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4696 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 22 2008 12:00AM |
| Updated: | Nov 05 2008 05:55PM |
| Credit: | Roberto Suggi Liverani discovered this issue. Stefano Di Paola added additional information. |
| Vulnerable: |
S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 Opera Software Opera Web Browser 9.60 beta 1 Opera Software Opera Web Browser 9.60 Opera Software Opera Web Browser 9.52 Opera Software Opera Web Browser 9.51 Opera Software Opera Web Browser 9.50 beta Opera Software Opera Web Browser 9.5 Opera Software Opera Web Browser 9.27 Opera Software Opera Web Browser 9.26 Opera Software Opera Web Browser 9.25 Opera Software Opera Web Browser 9.24 Opera Software Opera Web Browser 9.23 Opera Software Opera Web Browser 9.22 Opera Software Opera Web Browser 9.21 Opera Software Opera Web Browser 9.20 beta 1 Opera Software Opera Web Browser 9.20 Opera Software Opera Web Browser 9.10 Opera Software Opera Web Browser 9.02 Opera Software Opera Web Browser 9.01 Opera Software Opera Web Browser 9 Gentoo Linux |
| Not Vulnerable: |
Opera Software Opera Web Browser 9.61 |
Discussion
Opera Web Browser History Search Input Validation Vulnerability
Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, obtain sensitive information, or execute local programs in the context of the browser; other attacks are also possible.
Versions prior to Opera Web Browser 9.61 are vulnerable.
NOTE: This issue was previously documented in BID 31842 (Opera Web Browser HTML Injection and Cross Site Scripting Vulnerabilities) but has been given its own record to better document the details.
Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, obtain sensitive information, or execute local programs in the context of the browser; other attacks are also possible.
Versions prior to Opera Web Browser 9.61 are vulnerable.
NOTE: This issue was previously documented in BID 31842 (Opera Web Browser HTML Injection and Cross Site Scripting Vulnerabilities) but has been given its own record to better document the details.
Exploit / POC
Opera Web Browser History Search Input Validation Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following example exploit is available:
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following example exploit is available:
Solution / Fix
Opera Web Browser History Search Input Validation Vulnerability
Solution:
Opera 9.61 addresses this issue. Please see the references for more information.
Solution:
Opera 9.61 addresses this issue. Please see the references for more information.
References
Opera Web Browser History Search Input Validation Vulnerability
References:
References:
- Advisory: History Search can reveal browsing history (Opera)
- Opera Homepage (Opera Software)
- Opera Stored Cross Site Scripting Vulnerability (Roberto Suggi