Opera 'opera:config' Security Bypass Vulnerability
BID:41927
Info
Opera 'opera:config' Security Bypass Vulnerability
| Bugtraq ID: | 41927 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 05 2007 12:00AM |
| Updated: | Mar 05 2007 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Opera Software Opera Web Browser 8.51 Opera Software Opera Web Browser 8.50 Opera Software Opera Web Browser 8.0.2 Opera Software Opera Web Browser 8.0 2 Opera Software Opera Web Browser 8.0 1 Opera Software Opera Web Browser 8.0 Opera Software Opera Web Browser 7.54 Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52 Opera Software Opera Web Browser 7.51 Opera Software Opera Web Browser 7.50 Opera Software Opera Web Browser 7.23 Opera Software Opera Web Browser 7.22 Opera Software Opera Web Browser 7.21 Opera Software Opera Web Browser 7.20 Beta 1 build 2981 Opera Software Opera Web Browser 7.20 Opera Software Opera Web Browser 7.11 j Opera Software Opera Web Browser 7.11 b Opera Software Opera Web Browser 7.11 Opera Software Opera Web Browser 7.10 Opera Software Opera Web Browser 6.0.1 Opera Software Opera Web Browser 6.0 6 Opera Software Opera Web Browser 6.0 Opera Software Opera Web Browser 5.12 Opera Software Opera Web Browser 5.0 Linux Opera Software Opera Web Browser 5.0 2 win32 Opera Software Opera Web Browser 5.0 Mac Opera Software Opera Web Browser 9.10 Opera Software Opera Web Browser 9.02 Opera Software Opera Web Browser 9.01 Opera Software Opera Web Browser 9 Opera Software Opera Web Browser 8.54 Opera Software Opera Web Browser 8.53 Opera Software Opera Web Browser 8.52 Opera Software Opera Web Browser 8 Beta 3 |
| Not Vulnerable: |
Opera Software Opera Web Browser 9.20 |
Discussion
Opera 'opera:config' Security Bypass Vulnerability
Opera is prone to a security-bypass vulnerability because it fails to adequately restrict access through 'iframe' scripts.
Attackers can leverage this issue to alter the browser's configuration settings and potentially execute arbitrary code.
Versions prior to Opera 9.20 are vulnerable.
Opera is prone to a security-bypass vulnerability because it fails to adequately restrict access through 'iframe' scripts.
Attackers can leverage this issue to alter the browser's configuration settings and potentially execute arbitrary code.
Versions prior to Opera 9.20 are vulnerable.
Exploit / POC
Opera 'opera:config' Security Bypass Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.
Note: This issue is being exploited in the wild via the CRiMEPACK (and possibly other) exploit pack.
The following exploit code is available:
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.
Note: This issue is being exploited in the wild via the CRiMEPACK (and possibly other) exploit pack.
The following exploit code is available:
Solution / Fix
Opera 'opera:config' Security Bypass Vulnerability
Solution:
Updates are available; please see the references for more information.
Solution:
Updates are available; please see the references for more information.