Secunia Advisory SA11532 - Secunia has discovered a vulnerability in the Opera browser, which can be exploited by malicious people to fake (spoof) information displayed in the address bar. The vulnerability has been confirmed in version 7.23 for Windows and Linux. Prior versions may also be affected.
dc53e66630e90a2121277a9e645a4eb3320a8d21a55b9a23af104ae4d9089546
TITLE:
Opera Browser Address Bar Spoofing Vulnerability
SECUNIA ADVISORY ID:
SA11532
VERIFY ADVISORY:
http://secunia.com/advisories/11532/
CRITICAL:
Less critical
IMPACT:
Spoofing
WHERE:
>From remote
SOFTWARE:
Opera 7.x
DESCRIPTION:
Secunia has discovered a vulnerability in the Opera browser, which
can be exploited by malicious people to fake (spoof) information
displayed in the address bar.
The vulnerability is caused due to the Opera browser changing
information in the address bar as soon as the browser is "asked" to
redirect to a new page. However, using e.g. the <BODY> tag attribute
"onUnload", it is possible to abort the redirection without the
address bar being changed back.
This can be exploited by a malicious website to trick users into
thinking that they're on another website.
The vulnerability has been confirmed in version 7.23 for Windows and
Linux. Prior versions may also be affected.
SOLUTION:
Update to version 7.50.
http://www.opera.com/download/
PROVIDED AND/OR DISCOVERED BY:
Jakob Balle, Secunia Research.
ORIGINAL ADVISORY:
http://secunia.com/secunia_research/2004-2/advisory/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed