Opera Web Browser 9.62 History Search Input Validation Vulnerability
BID:32015
Info
Opera Web Browser 9.62 History Search Input Validation Vulnerability
| Bugtraq ID: | 32015 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 31 2008 12:00AM |
| Updated: | Nov 04 2008 02:35PM |
| Credit: | NeoCoderz |
| Vulnerable: |
Opera Software Opera Web Browser 9.62 Opera Software Opera Web Browser 9.61 Opera Software Opera Web Browser 9.60 beta 1 Opera Software Opera Web Browser 9.60 Opera Software Opera Web Browser 9.52 Opera Software Opera Web Browser 9.51 Opera Software Opera Web Browser 9.50 beta Opera Software Opera Web Browser 9.5 Opera Software Opera Web Browser 9.27 Opera Software Opera Web Browser 9.26 Opera Software Opera Web Browser 9.25 Opera Software Opera Web Browser 9.24 Opera Software Opera Web Browser 9.23 Opera Software Opera Web Browser 9.22 Opera Software Opera Web Browser 9.21 Opera Software Opera Web Browser 9.20 beta 1 Opera Software Opera Web Browser 9.20 Opera Software Opera Web Browser 9.10 Opera Software Opera Web Browser 9.02 Opera Software Opera Web Browser 9.01 Opera Software Opera Web Browser 9 |
| Not Vulnerable: | |
Discussion
Opera Web Browser 9.62 History Search Input Validation Vulnerability
Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, obtain sensitive information, alter the browser's configuration settings, or execute local programs in the context of the browser; other attacks are also possible.
Opera Web Browser 9.62 is vulnerable.
NOTE: This issue is related to BID 31992 (Opera Web Browser History Search and Links Panel Cross Site Scripting Vulnerabilities) and BID 31869 (Opera Web Browser History Search Input Validation Vulnerability), and may be caused by an incomplete fix for those issues.
Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, obtain sensitive information, alter the browser's configuration settings, or execute local programs in the context of the browser; other attacks are also possible.
Opera Web Browser 9.62 is vulnerable.
NOTE: This issue is related to BID 31992 (Opera Web Browser History Search and Links Panel Cross Site Scripting Vulnerabilities) and BID 31869 (Opera Web Browser History Search Input Validation Vulnerability), and may be caused by an incomplete fix for those issues.
Exploit / POC
Opera Web Browser 9.62 History Search Input Validation Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following exploit is available:
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following exploit is available:
Solution / Fix
Opera Web Browser 9.62 History Search Input Validation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Opera Web Browser 9.62 History Search Input Validation Vulnerability
References:
References:
- Opera Homepage (Opera Software)