Opera Mail client file:// cross-site scripting
| opera-mail-file-xss (22335) |  Medium Risk |
Description:
Opera Mail client is vulnerable to cross-site scripting. Files attached to messages in Opera Mail client are opened from the user's cache directory with no warning message provided before the file is opened. A remote attacker could send a specially-crafted URL containing embedded script in the context of file:// which, once the link is clicked, would be executed in the victim's Web browser within the security context of the hosting site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- Compaq, Tru64 6.4
- Opera, Opera Mail client 8.02
- SuSE, SuSE Linux 10.0
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux 9.1
- SuSE, SuSE Linux 9.2
- SuSE, SuSE Linux 9.3
Remedy:
Upgrade to the latest version of Opera Mail Client (8.50 or later), available from the Opera Download Web page. See References.
Consequences:
Gain Access
References:
- Opera Download Web page, Opera 8.50 for Windows at http://www.opera.com/download/.
- Opera Mail Web page, Opera Mail at http://www.opera.com/products/desktop/m2/.
- BID-14880: Opera Web Browser Mail Client Multiple Vulnerabilities
- CVE-2005-3006: The mail client in Opera before 8.50 opens attached files from the user's cache directory without warning the user, which might allow remote attackers to inject arbitrary web script and spoof attachment filenames.
- OSVDB ID: 19508: Opera Mail Client User Cache Directory file:// Arbitrary Script Execution
- SA16645: Opera Mail Client Attachment Spoofing and Script Insertion
- SUSE-SA:2005:057: opera: remote code execution
- VUPEN/ADV-2005-1789: Opera Browser Security Update Fixes Multiple Vulnerabilities
Reported:
Sep 20, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net