PT-2002-3126 · Opera+1 · Opera+2

Published 2002-12-31 · Updated 2016-10-18 · CVE-2002-2414

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Opera version 6.0.3

Description The issue occurs when Opera 6.0.3 is used with Squid 2.4 for HTTPS proxying and does not properly handle the acceptance of a non-global certificate authority (CA) certificate from a site, leading to a denial of service (crash) when establishing a subsequent HTTPS connection. This allows remote attackers to cause the crash.

Recommendations For Opera version 6.0.3, consider avoiding the use of non-global certificate authority (CA) certificates until a fix is available. As a temporary workaround, restrict the acceptance of certificates from unknown or untrusted sites to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-2414

Affected Products

Opera

Squid

Squid Cache

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-2414 · Security Note
• http://securityfocus.com/bid/6218 · Note
• http://iss.net/security_center/static/10673.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2414 · Note
• http://marc.info/?l=full-disclosure&m=103783186608438&w=2 · Note