PT-2004-2397 · Opera · Opera

Published 2004-12-31 · Updated 2022-02-28 · CVE-2004-1489

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opera versions 7.54 and earlier

Description The issue allows remote attackers to gain sensitive information, such as user names and the installation directory, due to improper limitation of an applet's access to internal Java packages from Sun. This can lead to an unauthorized information disclosure when an attacker uses the sun.security.krb5.Credentials class to retrieve the name of the currently logged in user and parse the home directory from the information provided by the thrown java.security.AccessControlException, resulting in a loss of confidentiality.

Recommendations For Opera versions 7.54 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2004-1489

Affected Products

Opera

References · 4

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029044.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1489 · Security Note
• http://opera.com/linux/changelogs/754u1 · Note
• http://gentoo.org/security/en/glsa/glsa-200502-17.xml · Patch, Vendor Advisory