CERT-In Advisory
CIAD-2010-0059
Multiple Vulnerabilities in Opera
Original Issue Date: August 20, 2010
Severity Rating: High
Systems Affected
- Opera versions prior to 10.61.
Overview
Multiple vulnerabilities have been reported in Opera, which could be exploited by remote attacker to bypass certain security restrictions, conduct clickjacking attacks, execute an arbitrary code or potentially compromise a vulnerable system.
Description
1. HTML5 canvas arbitrary code execution Vulnerability
This vulnerability is caused due to an error exists in the processing of painting operations on a canvas when certain transformations are being applied in Opera. A remote attacker could exploit this vulnerability via a specially crafted HTML5 canvas to trigger Heap-based buffer overflow error. Successful exploitation of this vulnerability could allow a remote attacker to execute an arbitrary code.
2. "Download" Dialog File Execution Vulnerability
(
CVE-2010-2576
)
The "Download" dialog provides the option to run a downloadable executable at a predictable location in the browser window.
This vulnerability is caused due to improper handling of clicks on download dialogs that became visible after a recent tab change in Opera. A remote attacker could exploit this vulnerability by tricking a user into clicking on the "Run" button by positioning a new window on top of the "Download" dialog that is closed. Successful exploitation of this vulnerability could allow a remote attacker to conduct clickjacking attacks and consequently execute an arbitrary code.
3. Arbitrary News feed subscription Vulnerability
This vulnerability is caused due to an input sanitisation error in the handling of news feed previews in Opera. A remote attacker could exploit this vulnerability via a specially crafted scripting code. Successful exploitation of this vulnerability could allow a remote attacker to execute script code and automatically subscribe the user to the feed without user interaction.
Solution
Upgrade to Opera 10.61.
http://www.opera.com/download/
Vendor Information
Opera
http://www.opera.com/support/kb/view/966/
http://www.opera.com/support/kb/view/967/
http://www.opera.com/support/kb/view/968/
References
Opera
http://www.opera.com/docs/changelogs/windows/1061/
http://www.opera.com/support/kb/view/966/
http://www.opera.com/support/kb/view/967/
http://www.opera.com/support/kb/view/968/
SecurityFocus
http://www.securityfocus.com/bid/42407
Security Tracker
http://securitytracker.com/alerts/2010/Aug/1024331.html
Secunia
http://secunia.com/advisories/40120/
VUPEN
http://www.vupen.com/english/advisories/2010/2079
ISS X-Force
http://xforce.iss.net/xforce/xfdb/61087
CVE Name
CVE-2010-2576
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|