Opera Browser URI Display Obfuscation Weakness

Bugtraq ID:	9281
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Dec 23 2003 12:00AM
Updated:	Dec 23 2003 12:00AM
Credit:	The disclosure of this issue has been credited to nesumin <[email protected]>.
Vulnerable:	Opera Software Opera Web Browser 6.0 6
Not Vulnerable:	Opera Software Opera Web Browser 7.23

Opera Browser URI Display Obfuscation Weakness

A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a supplied username, contains a specially crafted sequence of characters. These characters will be interpreted as a NULL due to UTF-8 encoding. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI to aid in obfuscating the URI for a visited page.

An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.

Opera Browser URI Display Obfuscation Weakness

Solution:
Opera version 7.23 is not prone to this issue.

Opera Browser URI Display Obfuscation Weakness

References:

• Opera Web Browser Home Page (Opera Software)
  
• Internet Explorer URL parsing vulnerability ("nesumin" )