PT-2005-2155 · Opera · Opera

Publicado 2005-04-14 · Atualizado 2022-02-28 · CVE-2005-1139

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Opera versions 8 Beta 3

Description The issue allows a malicious user to spoof web site SSL Organization Information, deceiving users into believing the site belongs to an organization that it does not. This is triggered by a feature that displays the SSL Organizational Information next to the web browser SSL lock symbol. The Organizational information within the SSL certificate is not unique, making it possible for a malicious website to pose as another, betraying consumer trust and resulting in a loss of confidentiality.

Recommendations For Opera version 8 Beta 3, consider disabling the feature that displays the SSL Organizational Information next to the web browser SSL lock symbol until a patch is available. Restrict access to websites with potentially spoofed SSL certificates to minimize the risk of exploitation. Avoid relying solely on the Organizational information displayed by the browser for authentication purposes.

Exploit

Correção

Identificadores relacionados

CVE-2005-1139

Produtos afetados

Opera

Referências · 6

• 🔥 http://geotrust.com/resources/advisory/sslorg/index.htm · Exploit
• http://novell.com/linux/security/advisories/2005_31_opera.html · Aviso do Fabricante
• http://geotrust.com/resources/advisory/sslorg/sslorg-advisory.htm · Aviso do Fabricante
• http://securityfocus.com/bid/13176 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40503 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1139 · Nota de Segurança