Apache-Talk @lexa.ru 

Inet-Admins @info.east.ru 

Filmscanners @halftone.co.uk 

Security-alerts @yandex-team.ru 

nginx-ru @sysoev.ru 

   


   


   

















      :: Security-alerts
Security-Alerts mailing list archive (security-alerts@yandex-team.ru)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[security-alerts] FW: [SA26074] Opera "data:" URI Scheme Address Bar Spoofing Vulnerability



>
> TITLE:
> Opera "data:" URI Scheme Address Bar Spoofing Vulnerability
>
> SECUNIA ADVISORY ID:
> SA26074
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/26074/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Spoofing
>
> WHERE:
> From remote
>
> SOFTWARE:
> Opera 9.x
> http://secunia.com/product/10615/
>
> DESCRIPTION:
> Robert Swiecki has discovered a vulnerability in Opera, which can be
> exploited by malicious people to conduct spoofing attacks.
>
> The vulnerability is caused due to an error in the handling of the
> "data:" URI scheme. This can be exploited to display arbitrary
> content while showing the URL of a trusted web site in the address
> bar when a user follows a specially crafted link.
>
> The vulnerability is confirmed in version 9.21. Other versions may
> also be affected.
>
> SOLUTION:
> Do not follow links from untrusted web sites.
>
> PROVIDED AND/OR DISCOVERED BY:
> Robert Swiecki
>
> ORIGINAL ADVISORY:
> http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/0
> 64638.html
>



 




Copyright © Lexa Software, 1996-2009.