PT-2004-2398 · Opera · Opera

Published 2004-12-31 · Updated 2022-02-28 · CVE-2004-1490

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opera versions 7.54 and earlier

Description The issue allows remote attackers to spoof file types in the download dialog. This is achieved via dots and non-breaking spaces (ASCII character code 160) in the Content-Disposition or Content-Type headers. A malicious user can send specially crafted headers to trick the user into executing malicious files, resulting in a loss of integrity.

Recommendations For Opera versions 7.54 and earlier, consider disabling the download dialog functionality until a patch is available. Restrict access to the Content-Disposition and Content-Type headers to minimize the risk of exploitation. Avoid using the Content-Disposition and Content-Type headers in the download dialog until the issue is resolved.

Fix

Related Identifiers

CVE-2004-1490

Affected Products

Opera

References · 8

• http://secunia.com/secunia_research/2004-19/advisory · Patch
• http://securityfocus.com/bid/11883 · Patch
• http://secunia.com/advisories/12981 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1490 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18423 · Note
• http://gentoo.org/security/en/glsa/glsa-200502-17.xml · Patch, Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/18423 · Note
• http://opera.com/linux/changelogs/754u1 · Note