Opera JavaScript Java Method Access Vulnerability
BID:7271
Info
Opera JavaScript Java Method Access Vulnerability
| Bugtraq ID: | 7271 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 03 2003 12:00AM |
| Updated: | Apr 03 2003 12:00AM |
| Credit: | Discovery is credited to "David F. Madrid" <[email protected]>. |
| Vulnerable: |
Opera Software Opera Web Browser 6.0.1 win32 |
| Not Vulnerable: |
Opera Software Opera Web Browser 7.0 2win32 |
Discussion
Opera JavaScript Java Method Access Vulnerability
It has been reported that it is possible in some versions of Opera to call some potentially dangerous Java methods (such as exec) from within JavaScript. This could be used to execute commands on a client system running a vulnerable version of the web browser.
It has been reported that it is possible in some versions of Opera to call some potentially dangerous Java methods (such as exec) from within JavaScript. This could be used to execute commands on a client system running a vulnerable version of the web browser.
Exploit / POC
Opera JavaScript Java Method Access Vulnerability
A proof-of-concept is available at the following locations:
http://usuarios.lycos.es/idoru/petaopera.html
http://usuarios.lycos.es/idoru/sockets.html
A proof-of-concept is available at the following locations:
http://usuarios.lycos.es/idoru/petaopera.html
http://usuarios.lycos.es/idoru/sockets.html
Solution / Fix
Opera JavaScript Java Method Access Vulnerability
Solution:
This issue does not appear to be present in Opera 7.02 for Windows. Upgrading to this version may address the issue, though this has not been confirmed.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
This issue does not appear to be present in Opera 7.02 for Windows. Upgrading to this version may address the issue, though this has not been confirmed.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Opera JavaScript Java Method Access Vulnerability
References:
References:
- Opera Web Browser Home Page (Opera Software)
- Using Java from Javascript ("David F. Madrid"