PT-2004-2397 · Opera · Opera

Publicado 2004-12-31 · Atualizado 2022-02-28 · CVE-2004-1489

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opera versions 7.54 and earlier

Description The issue allows remote attackers to gain sensitive information, such as user names and the installation directory, due to improper limitation of an applet's access to internal Java packages from Sun. This can lead to an unauthorized information disclosure when an attacker uses the sun.security.krb5.Credentials class to retrieve the name of the currently logged in user and parse the home directory from the information provided by the thrown java.security.AccessControlException, resulting in a loss of confidentiality.

Recommendations For Opera versions 7.54 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2004-1489

Produtos afetados

Opera

Referências · 4

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029044.html · Exploit
• http://opera.com/linux/changelogs/754u1 · Nota
• http://gentoo.org/security/en/glsa/glsa-200502-17.xml · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1489 · Nota de Segurança