PT-2004-2398 · Opera · Opera

Publicado 2004-12-31 · Atualizado 2022-02-28 · CVE-2004-1490

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opera versions 7.54 and earlier

Description The issue allows remote attackers to spoof file types in the download dialog. This is achieved via dots and non-breaking spaces (ASCII character code 160) in the Content-Disposition or Content-Type headers. A malicious user can send specially crafted headers to trick the user into executing malicious files, resulting in a loss of integrity.

Recommendations For Opera versions 7.54 and earlier, consider disabling the download dialog functionality until a patch is available. Restrict access to the Content-Disposition and Content-Type headers to minimize the risk of exploitation. Avoid using the Content-Disposition and Content-Type headers in the download dialog until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-1490

Produtos afetados

Opera

Referências · 8

• http://secunia.com/secunia_research/2004-19/advisory · Correção
• http://securityfocus.com/bid/11883 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18423 · Nota
• http://gentoo.org/security/en/glsa/glsa-200502-17.xml · Correção, Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/18423 · Nota
• http://secunia.com/advisories/12981 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2004-1490 · Nota de Segurança
• http://opera.com/linux/changelogs/754u1 · Nota